Windows Forum

Ask something
Discussion Locked

Restricting Internet access

0 helpful
11 replies

by r bailey

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Management has asked us to find a way to block certain users from accessing the Internet. We are running NT 4.0 Is it possible to give/deny users internet access on an NT network by using a Global/Local Group as the permission? In other words, can I setup an "InternetAccess" group on NT where only the users included in that group will be allowed internet access? I have been told this is possible but do you need to be using a proxy server to accomplish it? Our company doesn't have a proxy server and a local ISP houses our DNS server.

We have tried taking the DNS settings out of the users' network properties but they usually figure out how to put them back in. I know we can use a policy editor to restrict access to the network properties screen, but that's not good solution at this time.

Any help or suggestions are appreciated.

11 replies

by andrew_fairaizl

The proxy solution is probably the most straight forward solution. The IP's of the workstations can be blocked or allowed access to the internet. Are you using a gateway to get to the local ISP? The gateway (depending on software) can be configured to reject or allow access in the same manner. Another option would be to use a network protocol on those machines other than TCP/IP.
The other machines would need to have the same protocol as well to still be able to share information. Have you discussed options with the local ISP? They can block requests by MAC address if needed. One of the more effective methods is a stand alone firewall(switch and protection. Hope this at least gives you some ideas.

by rudolph(uk)

Yes, it is possible to alow only the members of a NT group to access the internet. But I'm afraid more details are necessary. How do your users access the ISP? Via RAS? Do you have a firewall? Is your network a NT domain or a workgroup? I assume that the DNS is the one of your ISP, how do you work the name resolution within your network?
In any case, for security reasons, you'd need to isolate your network installing a proxy server and/or a firewall. If you had a proxy you could easily restrict to only certain NT group the access to the Internet.

by sheastr

If you are only concerned about users having acces to the internet as far as using iexporer or netscape, you could easily just remove the everyone read permissions to the internet explorer folder and create a global group for internet access and apply that group to the folder. You would also want to dissallow user's from installing application's as they could just install their own web browser

by allan

Create a group for the users and use a group policy to run only allowed applications. Add all the exe names for the programs they use and DO NOT include iexplore.exe.

by cail

all you have to do is to remove dns, and gateways and create a policy for users not to be able to make changes or access network properties. Download a policy editor from microsoft. It is free

This discussion is closed to new replies.