We have a domain controller (Windows Server 2008R2) which is also our DNS server. The DNS server has a forwarder that points to OpenDNS (www.opendns.org).
All of our workstations (Windows XP Pro) are configured to point to our local DNS server. I don't want to keep blocking individual websites for all users as it's getting a bit messy.
Ideally, I would like to allow pretty much all websites (except a few of the categories in OpenDNS, for security reasons) and then if/when management decide a user is taking liberties I would be able to block their internet access for X days.
Is this possible with Active Directory? Maybe something in the users profile?
I realise that there is a lot of debate about whether these kind of issues are technical or managerial. I am trying to allow more access to all of our staff but keep the option to temporarily enforce a complete block for individual users. For example, if a user visits Facebook once or twice a day but it makes no impact on their work then it's fine. If, however, a user stays on Facebook all day then I would want to block their internet after a discussion with management and then unblock it a few days later and see if the lesson has been learnt for a while.