Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In a Windows Server 2003 environment, does anyone know a way of restricting internet access with groups and group policy?

share|improve this question
    
Can you provide more details about what you mean by restrict? Do you mean you want to block everything? –  Zoredache Sep 9 '09 at 0:10
    
Yes - block all internet access. –  The Woo Sep 9 '09 at 7:44

3 Answers 3

up vote 3 down vote accepted

That's not going to work :)

There is (afaik) no registry setting which enables or disables internet access and there definitely is no gpo setting to allow/deny internet use. I could think of a few (crappy, easily removable) obstacles that you could throw at your users but ultimately you should bloxk internet access at your firewall and/or proxy server.

  • you could set the gateway ip address to a bogus ip address (bad idea, because it slows the pc down, causes unwanted LAN-traffic and the user could - depending in his rights - chage it back): use netsh.exe (see MS Technet for an explanation) in the logon script
  • you could mess up the dns server so that the pc won't find internet-domains (bad idea, because you have to be veeery careful not to mess up windows domain stuff, lots of Domain info is stored in the dns so disabling is no option): see this Microsoft documentation for the specific gpo settings
  • you could set the Internet Explorer proxy setting to a bogus ip (bad idea, because it only affects Internet Explorer and the users can simply change it)

So i really woudl suggest: install a (transparent) squid proxy with (transparent) AD/NTLM authentication and block specific users there.

share|improve this answer
    
Any suggestions which transparent proxy to use? –  The Woo Sep 9 '09 at 0:27
    
"transparent" is just a concept: all internet treffic (you decide whether that applies only to Port80 (HTTP) or other traffic like messengers too) has to pass through the proxy - the users can't circumvent this, no proxy-setting is needed in the browsers. Use squid: see deckle.co.za/squid-users-guide/Transparent_Caching/Proxy and wiki.squid-cache.org/ConfigExamples –  brengo Sep 9 '09 at 1:00
    
Thanks Brengo! Sometimes "that's not going to work" is the most helpful answer because it saves loads of time chasing dead ends! John –  John Hoge May 10 '10 at 14:29

One quick thing you can do to block Internet access is to simply set a bogus proxy in the browser, and then block access to the browser configuration pages. Both of these things can be done via a Group Policy for Internet Explorer.

It won't block you users from using alternate browsers, or a PortableApps browser they brought in, but it will slow down the average person.

To really address this though you probably need to consider setting your firewall to block everything, and then setup a proxy to permit the traffic you actually want to allow.

share|improve this answer

We use GPO to set the proxy to a dummy address on machines which should not access the Internet. Other policies prevent software installation or access to removable media, as well as access to any application other than the one they need to use. While this may not stop someone who really knows what he/she is doing it is very effective against our production staff.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.