How to restrict user access to internet

I would like to know how to restrict certain users from using the internet on
client computers. I am running windows 2000 client PC's connected to a
windows SBS 2003 R2 Std edition Server. Does this have to be done through
Group policy and if so, how, or is there any other way.

"Joeb" <joeb1nospam@iprimus.com.au> wrote in message
news:DD4F9A56-B42B-4D1D-9FF6-A6E35C6D5F1C@microsoft.com...
>I would like to know how to restrict certain users from using the internet
>on
> client computers. I am running windows 2000 client PC's connected to a
> windows SBS 2003 R2 Std edition Server. Does this have to be done through
> Group policy and if so, how, or is there any other way.

Group policy is not the best way to do such things even usually.

A security group aware Proxy server like ISA is specifically designed
to do this.

After ISA is installed and configured, you merely setup groups for
allowing different Internet access (both who and what they can do,
so that some can use the Web, but others can use Web+FTP, and
still others have no access etc.)

--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)

I guess this would mean having to purchase ISA server as the server is
currently running standard edition which does not have ISA server. Is there
any other option which would not involve buying additional software.

"Herb Martin" wrote:

>
> "Joeb" <joeb1nospam@iprimus.com.au> wrote in message
> news:DD4F9A56-B42B-4D1D-9FF6-A6E35C6D5F1C@microsoft.com...
> >I would like to know how to restrict certain users from using the internet
> >on
> > client computers. I am running windows 2000 client PC's connected to a
> > windows SBS 2003 R2 Std edition Server. Does this have to be done through
> > Group policy and if so, how, or is there any other way.
>
> Group policy is not the best way to do such things even usually.
>
> A security group aware Proxy server like ISA is specifically designed
> to do this.
>
> After ISA is installed and configured, you merely setup groups for
> allowing different Internet access (both who and what they can do,
> so that some can use the Web, but others can use Web+FTP, and
> still others have no access etc.)
>
> --
> Herb Martin, MCSE, MVP
> http://www.LearnQuick.Com
> (phone on web site)
>
>
>

"Joeb" <joeb1nospam@iprimus.com.au> wrote in message
news:DDD9E431-A3FA-4234-9DE8-74DFDEBB8BCE@microsoft.com...
>I guess this would mean having to purchase ISA server as the server is
> currently running standard edition which does not have ISA server. Is
> there
> any other option which would not involve buying additional software.

Yes. Or a third party solution that offers domain integration for group
restrictions.

It isn't that expensive compared with the cost of real security breaches.

I know I am responding to an OLD post, but maybe he's still looking for a
solution...

You can also set a GPO that will specify an internet proxy of 0.0.0.0 This
way all requests to the internet get routed to a black hole. This does a
pretty good job and keeps people on the local network.

(Yes, there are some ways around this, but it is a good interim measure.)
--
Ryan Hanisco
MCSE, MCTS: SQL 2005, Project+
Chicago, IL


"Herb Martin" wrote:

>
> "Joeb" <joeb1nospam@iprimus.com.au> wrote in message
> news:DDD9E431-A3FA-4234-9DE8-74DFDEBB8BCE@microsoft.com...
> >I guess this would mean having to purchase ISA server as the server is
> > currently running standard edition which does not have ISA server. Is
> > there
> > any other option which would not involve buying additional software.
>
> Yes. Or a third party solution that offers domain integration for group
> restrictions.
>
> It isn't that expensive compared with the cost of real security breaches.
>
>
>

"Ryan Hanisco" <RyanHanisco@discussions.microsoft.com> wrote in message
news:FC2ADB40-884B-4958-8B60-2BDFB2AF00D0@microsoft.com...
>I know I am responding to an OLD post, but maybe he's still looking for a
> solution...
>
> You can also set a GPO that will specify an internet proxy of 0.0.0.0
> This
> way all requests to the internet get routed to a black hole. This does a
> pretty good job and keeps people on the local network.
>
> (Yes, there are some ways around this, but it is a good interim measure.)

Agreed, a lot of people prefer to use 127.0.0.x so that no real network
traffic is generated.

I don't mind if it is an old post -- I always like reading your posts and
you don't post in the same groups as me that much.


--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)

Hi
Of course this only works if you're not using Mozilla or any other than IE.

"Herb Martin" <news@learnquick.com> wrote in message
news:OPOBpLWoHHA.4424@TK2MSFTNGP03.phx.gbl...
>
> "Ryan Hanisco" <RyanHanisco@discussions.microsoft.com> wrote in message
> news:FC2ADB40-884B-4958-8B60-2BDFB2AF00D0@microsoft.com...
>>I know I am responding to an OLD post, but maybe he's still looking for a
>> solution...
>>
>> You can also set a GPO that will specify an internet proxy of 0.0.0.0
>> This
>> way all requests to the internet get routed to a black hole. This does a
>> pretty good job and keeps people on the local network.
>>
>> (Yes, there are some ways around this, but it is a good interim measure.)
>
> Agreed, a lot of people prefer to use 127.0.0.x so that no real network
> traffic is generated.
>
> I don't mind if it is an old post -- I always like reading your posts and
> you don't post in the same groups as me that much.
>
>
> --
> Herb Martin, MCSE, MVP
> http://www.LearnQuick.Com
> (phone on web site)
>
>