Is it possible to generate an easy to read report based on the traffic to websites from a users active directory domain name? I assume this could be managed by implementing some sort of non-transparent proxy, but not sure how one would go about doing so with a transparent proxy. So how would you go about setting this up?
You're going to need a proxy server that includes Active Directory integration. Not just for policy management, but you'll need to make sure it does reporting per user too (to solve your initial question). This, of course, is not going to be a cheap solution (support-wise) if you don't have enough knowledge to set this up with Squid (which is open source--free), as most AD integrated proxies that have good reporting, and are somewhat useful (off the box) will cost some money. You'll want to look at Forefront TMG (since it's Microsoft's own solution--and will be the best integrated with AD), but there are others that some will suggest here.
Some other resources to look at:
- Squid and Active Directory authentication
- How to install Squid web proxy with AD integration
Another thing to think about is to NOT look for a 'per AD user' reporting tool, but per host/network tool such as nTop.
Logs of transparent proxy (or SNMP-monitoring of gateway) are IP-based, so you will need to map IP-addresses to AD users. Unfortunately, I did not find any tools which do that automatically.
Luckily, number of abusers is not big, so I used either psloggedon or Trend Micro Console(which shows IP, MAC-address and AD name) to trace them back manually.