How do I create a Group Policy that will prevent my users from accessing specific web-sites? I am at the 2008r2 functional level.
You need to set up an outbound proxy (Threat Management Gateway, Squid, etc) and use Group Policy to force Internet Explorer to pass all traffic though this proxy if it is not in-line. If you make the proxy in-line, then all traffic will, obviously, pass through it regardless of IE settings, making the GPO pointless.
You cannot accomplish this natively though GPO without doing something kludgey like making a hosts file on a network share with the appropriate sites blocked and using the Group Policy Preferences file update setting to push it to computers. I really advise against this. Take the time to set up a proxy and do it the right way.
For a Computer policy, one possible method is to use a hosts file. You could create a custom hosts file that contains the names that you want to block, and deploy that using the Group Policy Preferences feature to copy files. (Computer Configuration > Preferences > Windows settings > Files).
Keep in mind that this approach may not offer the granularity desired in all scenarios, and you cannot block a tld in a hosts file, only specific names. It may also not be appropriate if the hosts file is in use for other pre-existing names. A typical entry may be:
Some domains are difficult to block due to the large number of host names and different fqdn's required.
For the file source, you could specify:
And be sure to copy the modified hosts file to that location.
File destination would be: %systemroot%\system32\drivers\etc\hosts
The "Action" would be "Replace".
Note that the normal group policy refresh applies to this GPO. Testing has conformed that the file will be re-copied at the normal interval (by default, 90 minutes for a computer gpo).