Deny user acces to Internet

The best way would to put the user at the end of the unemployment line. But see my answer here for how to do it using group policy
http://tinyurl.com/4haz8

Create a group and edit the GPO to set the default gatway to an IP that doesn't exist. Put the user in this group.

Problem solved. We did this for a school and when student's abused their Internet they went in the group for a 'detention' of sorts! They could still do everything on the network, but their Internet access was totally gone as long as they were part of that group.

If you are using a proxy server that utilizes NTLM authentication, specifically deny that user access through the proxy.

Static IP's - set up DHCP to force a specific IP on that user/box, or set up a static IP for him, then:

Set an internal router ACL up to deny port 80/443 destined for the internet.

Block him at the firewall or external router for that matter.

If you are using an ISA server, you can deny Internet access by group. Reply to this saying you use an ISA server and I'll put together instructions on setting this up.

If you are not using an ISA server, but are using Active Directory, set a policy for this person (group of people) so their proxy server is a non-existant IP address. They would still be able to change their proxy server if they know where to go unless you lock that down also.