3

We are planning to migrate from workgroup to Active Directory ( Windows Server 2008 R2: domain controller, DNS and Windows XP/7: workstation ). At this moment some computers are not allowed to access Internet ( we achieve this but letting blank the fields for DNS from network configuration window). Users does not have administrative privileges so they cannot change the settings. This works well no matter what Internet browser the users uses.

Can we do this in an Active Directory environment?

5
  • 1
    This would be more on-topic at superuser.com. This site is for programming questions, so you'd likely find more help over there anyway =)
    – jadarnel27
    Sep 16, 2011 at 12:20
  • Sure you can, there are many Traffic control systems out there like Kerio etc. They integrate well with AD (without 3rd party apps). I think if you just want to deny certain users mmm, I think that's possible too but not sure how exactly. May be by setting different default router. Good luck!
    – bakytn
    Sep 16, 2011 at 12:37
  • 1
    Warning: If you create a domain and the primary DNS is not local (ie: has entries for local computers, or is Active Directory integrated), and/or the clients are not set to use this DNS as their primary DNS entry, then you will likely experience very long logins, and will/can have troubles with group policy and startup/login scripting time-outs.
    – techie007
    Sep 16, 2011 at 14:27
  • Do you have a budget or are you looking for a FREE solution? Sep 16, 2011 at 15:26
  • 2
    If you don't have DNS for a client, then Active Directory won't work with it. DNS is used to identify the Domain Controllers. You need DNS whatever you do.
    – dunxd
    Sep 16, 2011 at 15:31

11 Answers 11

6

I think you're going about this the wrong way. uSlackr's idea would work. You can set a proxy server in group policy, but as Nixphoe said, that would only work for IE. Nixphoe's idea breaks the function of Active Directory so should be avoided. Every method for doing this using Active Directory is going to have some drawbacks.

The solution (even if it's not the answer you want) is to do this at your firewall. Most good firewalls have the ability to block internet access for a group of IP addresses. Just make sure those computers get the correct IP addresses but putting them in their own special VLAN on the switches or creating DHCP reservations for them.

5

If this is all in 1 subnet, just don't configure a gateway if you are using DHCP or configure it to something incorrect. The PCs would be able to hit everything on their subnet, and nothing outside it...simple.

1
  • Best practice usually has servers including DCs on a different subnet than clients. Jan 6, 2013 at 18:05
2

Before we bought web filter software, we accomplished this by setting the user's proxy settings to a non-existent proxy. This could be handled through a group policy setting or a user-based login script. As others have said, this will only work for IE and programs that use Windows Internet Settings.

2

This will only work with 7 and 2008 unfortunately, but firewall rules via GPO? Why not block outbound traffic on known ports (80, 443) to anything not in the local subnets for AD (if you need that, that is) and do so through Group Policy. Just occurred to me. Not sure if it is that practical because

2
  • +1 This is a robust solution for Windows 7 clients.
    – Nic
    Sep 22, 2011 at 1:52
  • And on that note I say you could augment it with the answer from @lluke to get the XP machines in line. The only problem I see with @uSlackr is IE only. This is exactly the kind of solution I would have used if I could pidgeon-hole users into IE use, but I do not condone torture. Haha.
    – songei2f
    Sep 22, 2011 at 7:08
1

You could use ISA or TMG with AD integration, use a rule to allow access depend on "internet access" AD group membership. Include WPAD config in DNS so that there is no config required for all end user devices and browsers.

1

Is there any objection to using a web filtering appliance like a Barracuda Web Filter? It's AD-aware and would probably be a more robust solution.

0

No, you cannot use the same method in an active directory enviroment. AD is reliant on DNS to work correctly.

A couple of of options that can be used instead off the top of my head:

  • Use a proxy server
    • Force everyone through a proxy and have it block those that should not have internet access
  • Block access for those machines at the firewall/router

Both of those approaches would be a better approach anyway since your uses could just go and set DNS servers in their configs now and your "protection" is useless.

0

So, you can set up the AD DNS servers internally to not forward requests to the root DNS servers, which will give you much the same effect; you'll have to put the AD DNS servers in the clients' DNS config, but DNS resolution will be able to go no further. However, this is a very weak way of blocking internet access, as your users would be able to memorize a DNS server address (such as Google's, 8.8.8.8), and then use nslookup to resolve DNS queries by hand.

If you do want to proceed, here is how to enable forwarders (turn them off, of course), and here is how to manage root hints (remove these entirely).

0

This is a job for a firewall. You belived you where blocking intenet access by leaving out DNS, but you actually where only breaking DNS resolution. A user who knows the IP of the site they want to access would have been able to reach it in your old configuratin.

Firwalls are the way to block traffic. Either block the traffic using windows firewall, or with your hardware firewall at the edge.

If you have many servers configured like this, a convient way to handle this might be to put all of them on their own vlan and block the entire vlans internet access.

Dont forget to account for how the machines are going to get updates to both the base OS and any software installed. You are creating a differnt, possibly worse problem if you never patch anything.

-1

Or you could leave the gateway field blank... AD needs DNS but in most cases your machines will get by without a gateway assuming they need no access at all to the internet.

4
  • This only works if your DCs are on the same subnet as the workstation. Even in small networks, it's good practice to have then on a separate vlan/subnet.
    – MDMarra
    Sep 18, 2011 at 13:05
  • If you're running the sort of network where you're just moving away from workgroup, I'd bet this is some way off, OP probably hasnt got switches that support vlans. I work for a company which provides filtering proxies, but sometimes people want a cheap trick..
    – Tom Newton
    Sep 18, 2011 at 18:25
  • Even better, you could have a gateway to access other internal nets, you just don't need a default gw. Be interesting to hear why the other downvoters think this is a poor answer - it might not be the best answer for everyone, but it mirrors what the OP did before.
    – Tom Newton
    Sep 19, 2011 at 9:09
  • +1 the OP never indicated a network topology and this is a viable solution if everything is in the same subnet. In smaller environments (as the OP indicates) this is quite common.
    – August
    Sep 23, 2011 at 14:08
-1

You could use a startup script to remove the default route.

C:\> ROUTE DELETE 0.0.0.0

This would prevent the computer from communicating with any hosts outside the local subnet, but still allow all communication within your local network. You can use organizational units in Active Directory so that the group policy only applies to the computers you specify.

You must log in to answer this question.