I have created a batch script which will block Facebook by amending the hosts file in this location C:\windows\system32\drivers\etc\hosts

This is the contents of the batch file:

@echo off
echo www.facebook.com >> C:\windows\system32\drivers\etc\hosts

I have tested this batch file on my local machine and it works however, it will only work when I run it as Administrator.

Is it possible to deploy this batch file to all computers on my network, running as administrator using Group Policy?

I am using Windows Server 2012.


Yes, you can deploy batch files via Group Policy that will run under the context of Local System. A very common way of doing so is Computer Startup scripts. (As opposed to User Logon scripts.)

Also, this is probably the worst possible way imaginable of blocking Facebook.

Computer Startup Script

From http://technet.microsoft.com/en-us/library/cc770556.aspx

Startup scripts are run under the Local System account, and they have the full rights that are associated with being able to run under the Local System account.

The Local System account is essentially even more powerful than Administrator.

  • Thanks, The reason I want to use Group Policy to block facebook is because I need granularity. I want to only block it for particular users. – pgunston Nov 17 '14 at 0:02
  • 2
    @pgunston this information would clarify the question. – 030 Nov 17 '14 at 0:08
  • I achieved my goal by using Symantec Endpoint Protection Management Server rather than using DNS. – pgunston Nov 19 '14 at 3:27
  • I know I'm a year late, just wanted to iterate a bit on what Ryan said. This is the worst way of blocking Facebook because it relies on a lot and only works on IE. So if someone were to download another browser, that hosts file becomes pointless. However, if your network is locked down, everyone is domain user and downloads of Chrome are disabled, and you have all proxies blocked, then you should be fine, lol. – Jonas Lear Nov 3 '15 at 19:55
  • 1
    Jonas, that completely wrong. The DNS client on every operating system looks at the hosts file before running a query against the configured DNS servers. Every program running on the operating system, certainly all of the web browsers, use the operating system's DNS client to find hosts on the network. This is not just an IE fix, it will affect every program running on the machine that uses DNS normally. – Craig Mar 5 '17 at 3:40

You might want to change this to: www.facebook.com 

If you use the loopback address you'll have to wait for a timeout unless there is a local web server.

  • Are you sure about that? If you ping, it will respond immediately UNLESS that mechanism has been subverted somehow on your machine or your network. – Craig Mar 5 '17 at 3:42
  • You're listening for ping on localhost, but likely not for http traffic. Try again with http-ping or ping an unreachable host. – Dylan Knoll Mar 5 '17 at 3:50
  • That might be a fair point. But if the objective is to block access to an objectionable website, why worry about a timeout? I have a ready answer, of course, which is that you get Facebook assets (tracking scripts, primarily) injected into other web pages all over the web, and a timeout accessing the facebook.com domain would impact the load time of every such page. – Craig Mar 5 '17 at 3:52
  • Why ask the question if you already know the answer? ;) – Dylan Knoll Mar 5 '17 at 3:53
  • haha, well, one the one hand I don't care if they experience a timeout trying to access something I'm blocking. On the other hand... the law of unintended consequences. ;) – Craig Mar 5 '17 at 3:54

I know this is an old post, but what the heck. I'm not sure what's up with the naysayers. Pointing the objectionable domain to the local loopback address seems like a perfectly fine way to block access. It'll prevent DNS from returning the real address of the Facebook site, and if the user is not a local administrator, even if they know about the hosts file, which they probabaly don't, they won't have permissions to change it.

The problem I see with your approach is that if you got it running, you'll be appending that same line to your hosts file over and over again indefinitely.

If you're going to do this, you should have a script that looks for that line in the file, and only appends it if it doesn't already exist (and perhaps edits it if it doesn't say what you want it to).

Finally, running as the local SYSTEM account won't work if the script needs network access, unless you grant adequate permissions to the AD "Domain Computers" group and are prepared to do a little debugging.

  • Welcome to serverfault. There are a lot of "head scratching" answers here. – Jim B Mar 5 '17 at 4:33
  • As there are everywhere, I suppose. And thank you for the welcome. ;-) – Craig Mar 5 '17 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.