Stop certain users accessing internet

Here is a discussion on this very topic, involving setting IPSec in Group Policy, then applying it to a certain OU:
http://tinyurl.com/2okjj

Very easy. Create a group policy for the users you want to restrict. In that policy configure the proxy policy with a bogus IP address. Also in the same policy restrict the users ability to change the proxy settings.

Log on as Administrator or account with administrative right.
Create a group, say NoInternet, and put all users whom you do not want to access Internet in that group.
Make sure none of them belongs to a group (for example, Power Users) that can install browser programs.

Open Command Prompt and navigate to the folder where iexplore.exe is (typically, Winnt\Internet Explorer).

Type the following command and enter.

CACLS iexplore.exe /D NoInternet

The above command denies NoInternet group to run iexplore. If there is other browser, you must specify that one too.

If you are using Active Directory and want to do it through Group Policy just creat an OU called No Internet for example and put users in there that you don't want to have internet access. Then create a Group Policy on that OU that sends the users to a nonexistent proxy server for their internet access. You may also want to disable the connections tab in the Internet Control Panel so they can't change this. It is very simple to set up. I use it for three different domains that I manage. If you have any questions email me at jlbpotter@hotmail.com.

This question was closed by the author