I am using ISA 2004 on Windows 2003 Ent Server for web proxy service in my organization. I have to place policy to restrict particular users to access defined URLs which I easily defined by adding a user set from active directory and creating a URL set of those prohibited URLs and creating a access rule by denying the selected user set and that particular URL set. I am using hardware firewall on which NAT is active for http and https service routing to my ISA server’s local IP address.To keep the web service running I have to set my ISP’s dns addresses in primary DNS in ISA server and local dns as secondary due to which ISA server is unable to put that policy on the Active directory users. If I move the local DNS to primary the policy starts working but the web service stops working. Is there any work around for this. I need suggestions. Thanks in anticipation.