Networks

Ask something
Question Locked

Workgroup & Domain in ISA2004

0 helpful
3 replies

by philippians

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We have a domain server (SBS W2K3 Premium Edition) and with it is ISA2004. We are having a DSL connection connected to the server with one NIC. Worstations are connection via switch to the server. We also have one workgroup. My problem is I can't restrict the workgroup from using the internet. Connection to the internet is thru ISA is per authentication and per internet user only. But still they can access the internet. Can any body help. Thank you very much.

3 replies

by hal 9000

By any computers connected to the server.

If you need to achieve this you'll need to instigate a Group Policy to prevent any of the workgrouped computers having an Internet access. Even then they will need to be connected through the server if they are connected directly to the switch the server can have no control over them so to prevent these from gaining an Internet access you'll need to have a second LAN Connection on the server feeding the workgroup and prevent that from making a direct connection to the Internet though if you have XP SP2 involved in the workgroup you'll need to push out Windows Updates from the server.

So you'll effectively need to configure this as a WUS Server for the workgroup as if they are unable to get any Windows Updates they will close down and throw up a Pirate Software Warning screen while locking the computers up till this issue is fixed.

Col

by cg it

HAL isn't correct about ISA Server. ISA can block internet access for any client that connects through it. If computers that are not part of your SBS domain can access the internet, then ISA server is not configured properly. A properly configured ISA server blocks all traffic unless specifically allowed by rules. Default on SBS is to allow traffic only for those users that are members of the Internet Users Security Group.

workgroup computers that are not part of the domain would not get the proxy settings required to connect through ISA therefore should be a 403 error page stating ISA server denied the URL.

This discussion is closed to new replies.