Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are planning to migrate from workgroup to Active Directory ( Windows Server 2008 R2: domain controller, DNS and Windows XP/7: workstation ). At this moment some computers are not allowed to access Internet ( we achieve this but letting blank the fields for DNS from network configuration window). Users does not have administrative privileges so they cannot change the settings. This works well no matter what Internet browser the users uses.

Can we do this in an Active Directory environment?

share|improve this question

migrated from Sep 16 '11 at 15:05

This question came from our site for computer enthusiasts and power users.

This would be more on-topic at This site is for programming questions, so you'd likely find more help over there anyway =) – jadarnel27 Sep 16 '11 at 12:20
Sure you can, there are many Traffic control systems out there like Kerio etc. They integrate well with AD (without 3rd party apps). I think if you just want to deny certain users mmm, I think that's possible too but not sure how exactly. May be by setting different default router. Good luck! – bakytn Sep 16 '11 at 12:37
Warning: If you create a domain and the primary DNS is not local (ie: has entries for local computers, or is Active Directory integrated), and/or the clients are not set to use this DNS as their primary DNS entry, then you will likely experience very long logins, and will/can have troubles with group policy and startup/login scripting time-outs. – techie007 Sep 16 '11 at 14:27
Do you have a budget or are you looking for a FREE solution? – SpacemanSpiff Sep 16 '11 at 15:26
If you don't have DNS for a client, then Active Directory won't work with it. DNS is used to identify the Domain Controllers. You need DNS whatever you do. – dunxd Sep 16 '11 at 15:31

10 Answers 10

I think you're going about this the wrong way. uSlackr's idea would work. You can set a proxy server in group policy, but as Nixphoe said, that would only work for IE. Nixphoe's idea breaks the function of Active Directory so should be avoided. Every method for doing this using Active Directory is going to have some drawbacks.

The solution (even if it's not the answer you want) is to do this at your firewall. Most good firewalls have the ability to block internet access for a group of IP addresses. Just make sure those computers get the correct IP addresses but putting them in their own special VLAN on the switches or creating DHCP reservations for them.

share|improve this answer

If this is all in 1 subnet, just don't configure a gateway if you are using DHCP or configure it to something incorrect. The PCs would be able to hit everything on their subnet, and nothing outside it...simple.

share|improve this answer
Best practice usually has servers including DCs on a different subnet than clients. – JamesBarnett Jan 6 '13 at 18:05

Before we bought web filter software, we accomplished this by setting the user's proxy settings to a non-existent proxy. This could be handled through a group policy setting or a user-based login script. As others have said, this will only work for IE and programs that use Windows Internet Settings.

share|improve this answer

This will only work with 7 and 2008 unfortunately, but firewall rules via GPO? Why not block outbound traffic on known ports (80, 443) to anything not in the local subnets for AD (if you need that, that is) and do so through Group Policy. Just occurred to me. Not sure if it is that practical because

share|improve this answer
+1 This is a robust solution for Windows 7 clients. – Nic Sep 22 '11 at 1:52
And on that note I say you could augment it with the answer from @lluke to get the XP machines in line. The only problem I see with @uSlackr is IE only. This is exactly the kind of solution I would have used if I could pidgeon-hole users into IE use, but I do not condone torture. Haha. – songei2f Sep 22 '11 at 7:08

You could use ISA or TMG with AD integration, use a rule to allow access depend on "internet access" AD group membership. Include WPAD config in DNS so that there is no config required for all end user devices and browsers.

share|improve this answer

Is there any objection to using a web filtering appliance like a Barracuda Web Filter? It's AD-aware and would probably be a more robust solution.

share|improve this answer

No, you cannot use the same method in an active directory enviroment. AD is reliant on DNS to work correctly.

A couple of of options that can be used instead off the top of my head:

  • Use a proxy server
    • Force everyone through a proxy and have it block those that should not have internet access
  • Block access for those machines at the firewall/router

Both of those approaches would be a better approach anyway since your uses could just go and set DNS servers in their configs now and your "protection" is useless.

share|improve this answer

So, you can set up the AD DNS servers internally to not forward requests to the root DNS servers, which will give you much the same effect; you'll have to put the AD DNS servers in the clients' DNS config, but DNS resolution will be able to go no further. However, this is a very weak way of blocking internet access, as your users would be able to memorize a DNS server address (such as Google's,, and then use nslookup to resolve DNS queries by hand.

If you do want to proceed, here is how to enable forwarders (turn them off, of course), and here is how to manage root hints (remove these entirely).

share|improve this answer

Or you could leave the gateway field blank... AD needs DNS but in most cases your machines will get by without a gateway assuming they need no access at all to the internet.

share|improve this answer
This only works if your DCs are on the same subnet as the workstation. Even in small networks, it's good practice to have then on a separate vlan/subnet. – MDMarra Sep 18 '11 at 13:05
If you're running the sort of network where you're just moving away from workgroup, I'd bet this is some way off, OP probably hasnt got switches that support vlans. I work for a company which provides filtering proxies, but sometimes people want a cheap trick.. – Tom Newton Sep 18 '11 at 18:25
Even better, you could have a gateway to access other internal nets, you just don't need a default gw. Be interesting to hear why the other downvoters think this is a poor answer - it might not be the best answer for everyone, but it mirrors what the OP did before. – Tom Newton Sep 19 '11 at 9:09
+1 the OP never indicated a network topology and this is a viable solution if everything is in the same subnet. In smaller environments (as the OP indicates) this is quite common. – August Sep 23 '11 at 14:08

You could use a startup script to remove the default route.


This would prevent the computer from communicating with any hosts outside the local subnet, but still allow all communication within your local network. You can use organizational units in Active Directory so that the group policy only applies to the computers you specify.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.