group policies

How can I restrict internet access? Web surfing is becoming a problem in certain departments, but these people will still need access to a limited number of sites. (Running a 2000 network) Thanks.