Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a bunch of users that need to use the internet but I want to limit what websites they can get too.

I know u can go to IE and just select the diffrent websites but my users also use fire fox and chrome for a data base program via the web..

Is there a way to only allow certain users in a group to only vist website 1 2 3 4 5 6 7 8 and thats it via group poicy??

Thanks for the help

share|improve this question

There is no stock functionality in Windows Server 2003 and the Group Policy on Windows client OS's to do what you're looking for in any meaningfully easy way. Your best bet is to evaluate products that provide such functionality rather than trying to "roll your own".

There are a variety of products on the market that do this. I don't want this to degenerate into a "shopping question", but some quick searches ought to bring you back a number of Free/Open Source and commercial products that can do this.

share|improve this answer
what would i be trying to search for? – user160605 Mar 6 '13 at 1:14
I'd do a search for something like: corporate web filtering software That's giving me a number of very good results using Google. – Evan Anderson Mar 6 '13 at 1:35

Well if you want to only allow eight websites like your OP says, you could just map those sites to their proper IP's in the host file and for everything else do mapped to . You can apply these changes with a login script.

share|improve this answer
-1 - It's 2013. Anything that involves the phrase "HOSTS file" is very likely a bad idea. That having been said, Windows doesn't support wildcards in the HOSTS file anyway. You could do some trickery with a wildcard DNS record but you'd end up everything being able to resolve (which is a bad idea). You could put up a DNS server that's authoritative only for the domains the users should be able to access (which would, at least, give you NXDOMAINs for all other domains) but then you've got to keep it updated. That all sounds like a bad idea. A layer 7 solution is a lot better. – Evan Anderson Mar 5 '13 at 21:07
I have seen this done (for IE Only) by forcing all sites through a non-existant proxy server, and then utilising for the "Do not use Proxy for the following sites" rule. It sucked. – Mark Henderson Mar 5 '13 at 21:10
Ah you're right, no wildcards in the host file. There are hostsfile "enhancers" he could use that will allow the use of wildcards though. – Copy Run Start Mar 5 '13 at 21:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.