Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to configure group policy on a windows 2003 server to restrict/block external web access to certain groups of users?

Thanks, John

share|improve this question

Restricting Specific Web Sites in Internet Explorer Using Group Policy

share|improve this answer
Oooo, good link. – Wesley May 7 '10 at 18:43

You could configure a GPO to apply to a OU that the restricted users are in that applies a false proxy to IE. If you can't get your users in different OUs for structural reasons, you could also create the GPO, apply it to the top level OU and only grant that one user group that permission to apply the policy. That doesn't help if they're administrators or if they use a non IE browser.

You could hand out DHCP leases to that subset of computers and place a false default gateway in... I hope you don't have different network segments within the same network that they'd need access to as well.

All told, the best way to do this is with an appliance or system that is specifically designed to grant access to various network locations based on the LDAP user requesting the access.

share|improve this answer

Yes it's under User Configuration --> Policies>Windows Settings>Internet Explorer Maintenance>Security>Security Zones and Content Ratings. You will need to create a policy for each version of IE that you use. You can either import your current settings or create new ones. You must creat this GPO with the same version of IE installed that you are targeting.

share|improve this answer

You could run something like ISA server which would more suited to what you want, and restrict access via groups using that.

share|improve this answer

Block Web Browsing but Allow Intranet Traffic with IPSec

This is geared towards an individual computer, but can be used in a domain group policy as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.