Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just setup a network running on windows server 2008 R2. the server serves as DC with AD services, DNS, DHCP roles installed.

MY issue is this, due to the limited bandwidth size, we decided to limited internet usage to a few officers in the organisation. however, on joining client computers to the domain, they inherit DNS properties already configured on the server and connects directly to the internet.

My question: how do i restrict some of these clients from having access to the internet?

Your response is highly appreciated.


share|improve this question

You would best be served by looking at 3rd party internet filtering software/appliances and/or looking at what your firewall can provide in terms of internet filtering. Many enterprise firewalls provide this capability "built in".

In theory, you could push a policy to set users browsers to a non-existent proxy server. But this can be easily worked around and can cause other problems if not done without first thinking about what you are doing.

share|improve this answer

AD is probably not the best tool to use but you should be able to do a few things to achieve this. Here are some ideas that might help.

  • Using group policy you could create block port 80, etc for a group of employees pushing firewall settings.
  • Like @Rex said above you could go the proxy route.
  • You might be able to use group policy as well to lock down IE with it's security settings.

Preferably I would do this with a firewall if your firewall supports filtering, etc at the client level. There is probably no great way to do this with AD but there are some things you can do to make it more difficult.

Good Luck.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.