denying access

Somehow the proxy will have authorisation. Either based on the network logon (ADS or NT), or based on a separate registration.
Simply configure the proxy that certain groups of users DO have access to Inet, and others don't - and of course that anyone passing thru the proxy DOES need to be authorised...

HTH,
- The Netherlands

Don't know if you're using MS Proxy 2 or some other, but in MSP2 you don't get an option to deny access to users or groups.

In our shop, we have IE pre-configured with the settings locked down. To prevent staff from accessing the web, we remove the required proxy config settings from IE.

It's one workaround you could try if you're in a similar position.

To add to the above comment on the IE configuration:
What we do at my job is we run a registry update in the logon script that configures certain users to use the proxy server.
We connected a system to the proxy server, then exported the workstation's entire Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

We saved it to a file (proxyyes.reg).
Then, in the users who should use the proxy server, we just added 1 line to their logon script:

call proxyyes.reg

(the REG file is in the NETLOGON share on the domain controllers)(this is a mixed-mode network, with NT as the PDC).

For the non-proxy users, the same process applies. We config'd a system to NOT use proxy (thereby not getting Internet access), and exported the same registry key to a file (proxyno.reg).
Their logon scripts call this REG file.

This is not a glamorous solution, and there are problems (if a user logs in locally to the box, with a local machine account - if they know of one - instead of their domain account, they use whatever is the last registry modification done), but it mostly does the job.

Hope this helps.

This question was closed by the author