I'm trying to set up fine-grained control of external websites based on our users' and computers' AD group memberships.
Generally, we block sites such as YouTube, Facebook, MySpace et al - but our video department need YouTube access; the Marketing department need access to Facebook, and so on. We also have a number of PCs that should have unrestricted Web access. Currently this is administered using static IPs entered into our firewall configuration - which is time-consuming and error-prone, and it'd be much easier to do it via AD group membership, and it turns out our existing hardware firewall doesn't support this scenario :(
So, our requirements are:
Control USER-LEVEL access to particular websites via Active Directory group membership. Users who are members of the ''Facebook Users'' group in Active Directory can access Facebook during office hours, regardless of which computer they are using, and users who are NOT members of the ''Facebook Users'' should not be able to access this site during office hours. We want to repeat this for 5-6 different websites, and manage access entirely through AD group membership.
Control COMPUTER-LEVEL access to particular websites - i.e. I'd like to be able to make a specific domain computer a member of the ''Facebook Users'' group, so that any user who is using that computer has access to Facebook, regardless of the user's AD group memberships.
Ideally, all this is completely transparent to the end user - they shouldn't need to enter their network credentials again. Also, setting up a local proxy, etc. is fine as long as it's managable via group policy.