block website on terminal server

I have a dc and a ts. i am trying to block certain websites. for example facebook. do i go thru the gpo on the dc or can i do it thru the security tab on the ts. i have tried everything. i enter the url in restricted sites area on the internet option tab on the ts, but then when i log into as a user thru the ts, they can still get to the page. very frustrating, time consuming. i wouldn’t think it should be this difficult. if it says restricted, you put the url there, then why doesn’t it restrict it?????? also, if it is thru the dc, where do i go to do this?

I have had this similar question on here before, but not in a position to set up a proxy yet.

Thanks