Networks

Ask something
Discussion Locked

Restrict Internet Access by group

0 helpful
4 replies

by sceva 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

How can I restrict access to the internet for a specific group of users on a group of computers?

I work for a boys home and we have a training room that both staff and boys use. We are running Active Directory on W2k network and Windows XP on the computers in question. I want the boys to be able to log on and have access to network resources on these computers, but not get out to the internet. (We provide other computers where they can log onto and have access to the internet/email) I also want staff members to be able to log onto these computers and be able to access the internet.

4 replies

by mshavrov

There are many ways how to do that. All depends on how you need to do that and how much "extra" money you ready to spend.

1. Simpliest method - modify users profiles (group policies) in Active Directories. You may modify, for example, "Proxy Settings" in Internet Explorer properties. Configure PCs with either fake IP address or with IP address of some internal WEB server (for example, you may even create default page, saying "Internet Access Prohibited..."). But not rely on this method too much. "Boys" may come with some tricks to override these settings. Sure, you may try to disable access to IE and Control Panel properties, but again, it's not 100% solution.

2. Install Proxy Server / Firewall with authentication. It will create some "overhead" since everybody should enter username and password when they start using Internet, but it will cut all "not-allowed" connections at "exit point". Theoretically, you may integrate Firewall/Proxy authentication and authorization with Active Directory.

3. Separate "boys" computers (for example, located in class) with "employee" computers, configure them with different IP addresses and allow Internet access on your router/firewall for only "employee" IP addresses. But I think it's not a solution in your case, since you want employee to access the same computers.

If you have more questions, send me e-mail.

Good luck,

Michael Shavrov
CSS1, CCNA, CCDA, MCSE+I, MCSE W2K, CCSA, SCSA

by sceva

I would prefer to implement something in line with item #1, but I have been unable to determine a way to have the settings apply only when the "boys" log onto specific computers. I don't know how to apply the settings on a group and computer basis. (We are also using Scriptlogic, if that can be of use!)

This discussion is closed to new replies.