Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make my network Active Directory controlled.

I want to enable internet connectivity in my client computers through some kind of startup/logon script.

How do I achieve this?


share|improve this question
up vote 1 down vote accepted

Proxy Server that requires AD authentication and have Active Directory set the proxy settings of user.

You also should have the users on a LAN that has no route to the internet when doing this.

share|improve this answer
Is there any other way without using a normal proxy? – Josh May 15 '09 at 18:25
Without a proxy you'd have to use some sort of 802.1x on the network to stop people from sending traffic to the internet. – sparks May 15 '09 at 18:31

If your intent is to restrict internet access, you could set up a group policy in AD that points internet explorer to a non-existent proxy. Here's a link with some instructions for setting proxy on GPO. If you're trying to enable only to some sites, you could put these in the ignore list for the proxy server using the same GPO -- requests for these sites would then go to the gateway.

The drawback is that this works only if IE is the browser, if a user installs Firefox -- or any other browser or network application -- they can set/remove the proxy themselves.

Filtering is usually best done at a gateway or proxy (in one place). Is there a specific objection to a proxy? There are some good and easy to install/configure free ones out there.

share|improve this answer
And if you can shell out for it, ISA is slick and definitely the best-integrated proxy for an AD environment. – nedm May 15 '09 at 18:50

You can buy cheap routers with linux installations that you can customize.

One option, therefore, is to configure the router to gateway clients that have signed in correctly, and drop everyone else's packets.


share|improve this answer
I'm infact having Winroute firewall and this doesn't seem possible with it – Josh May 16 '09 at 3:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.