Block Internet sites for certain users

Hi.
I need to block certain users in the office from accessing certain websites
and specifically Live Messenger as they are abusing the system.
I have Windows Server 2003 for Small Business Server SP2.
How can I do this?

With Premium Edition, this is a straightforward rule in ISA. With Standard
Edition, you'll need to look at some sort of third party solution, or a bit
of manual editing of a HOSTS file on the user's computer. This later is a
kludge only, though.

--
Charlie.
http://msmvps.com/xperts64
http://mvp.support.microsoft.com/profile/charlie.russel


"Rayasiom" <Rayasiom@discussions.microsoft.com> wrote in message
news:E7F1B65D-D7D4-4E54-AA6D-2BBFACDE65E3@microsoft.com...
> Hi.
> I need to block certain users in the office from accessing certain
> websites
> and specifically Live Messenger as they are abusing the system.
> I have Windows Server 2003 for Small Business Server SP2.
> How can I do this?

This is where the problem lies - we do not have ISA.
It is something that I would like to be able to control on the server and
just add websites as they become a problem. The manual editing side of things
is not as easy as it sounds either as we have tried to create a new group
under Group Policy Objects, edit it and under User Config, Windows Settings,
Internet Explorer Maintenance, Security - then adding the sites we don't want
the specific users to have access to.
Have also gone into that same edit of the new group to Computer Config,
Admin Settings and not allowing windows messenger, then running gpupdate
/force
No joy is to be had from the above....

"Charlie Russel - MVP" wrote:

> With Premium Edition, this is a straightforward rule in ISA. With Standard
> Edition, you'll need to look at some sort of third party solution, or a bit
> of manual editing of a HOSTS file on the user's computer. This later is a
> kludge only, though.
>
> --
> Charlie.
> http://msmvps.com/xperts64
> http://mvp.support.microsoft.com/profile/charlie.russel
>
>
> "Rayasiom" <Rayasiom@discussions.microsoft.com> wrote in message
> news:E7F1B65D-D7D4-4E54-AA6D-2BBFACDE65E3@microsoft.com...
> > Hi.
> > I need to block certain users in the office from accessing certain
> > websites
> > and specifically Live Messenger as they are abusing the system.
> > I have Windows Server 2003 for Small Business Server SP2.
> > How can I do this?
>
>

If this is really important then you should consider upgrading to SBS 2003
PE so you can install ISA 2004. As Charlie says your task will then be much
easier.

"Rayasiom" <Rayasiom@discussions.microsoft.com> wrote in message
news:8C742A71-8753-4A52-8464-027ADF8F0D03@microsoft.com...
> This is where the problem lies - we do not have ISA.
> It is something that I would like to be able to control on the server and
> just add websites as they become a problem. The manual editing side of
> things
> is not as easy as it sounds either as we have tried to create a new group
> under Group Policy Objects, edit it and under User Config, Windows
> Settings,
> Internet Explorer Maintenance, Security - then adding the sites we don't
> want
> the specific users to have access to.
> Have also gone into that same edit of the new group to Computer Config,
> Admin Settings and not allowing windows messenger, then running gpupdate
> /force
> No joy is to be had from the above....
>
> "Charlie Russel - MVP" wrote:
>
>> With Premium Edition, this is a straightforward rule in ISA. With
>> Standard
>> Edition, you'll need to look at some sort of third party solution, or a
>> bit
>> of manual editing of a HOSTS file on the user's computer. This later is a
>> kludge only, though.
>>
>> --
>> Charlie.
>> http://msmvps.com/xperts64
>> http://mvp.support.microsoft.com/profile/charlie.russel
>>
>>
>> "Rayasiom" <Rayasiom@discussions.microsoft.com> wrote in message
>> news:E7F1B65D-D7D4-4E54-AA6D-2BBFACDE65E3@microsoft.com...
>> > Hi.
>> > I need to block certain users in the office from accessing certain
>> > websites
>> > and specifically Live Messenger as they are abusing the system.
>> > I have Windows Server 2003 for Small Business Server SP2.
>> > How can I do this?
>>
>>

If this is a requirement, then you should upgrade. ISA will do what you
need, and the upgrade is simple.

--
Charlie.
http://msmvps.com/xperts64
http://mvp.support.microsoft.com/profile/charlie.russel


"Rayasiom" <Rayasiom@discussions.microsoft.com> wrote in message
news:8C742A71-8753-4A52-8464-027ADF8F0D03@microsoft.com...
> This is where the problem lies - we do not have ISA.
> It is something that I would like to be able to control on the server and
> just add websites as they become a problem. The manual editing side of
> things
> is not as easy as it sounds either as we have tried to create a new group
> under Group Policy Objects, edit it and under User Config, Windows
> Settings,
> Internet Explorer Maintenance, Security - then adding the sites we don't
> want
> the specific users to have access to.
> Have also gone into that same edit of the new group to Computer Config,
> Admin Settings and not allowing windows messenger, then running gpupdate
> /force
> No joy is to be had from the above....
>
> "Charlie Russel - MVP" wrote:
>
>> With Premium Edition, this is a straightforward rule in ISA. With
>> Standard
>> Edition, you'll need to look at some sort of third party solution, or a
>> bit
>> of manual editing of a HOSTS file on the user's computer. This later is a
>> kludge only, though.
>>
>> --
>> Charlie.
>> http://msmvps.com/xperts64
>> http://mvp.support.microsoft.com/profile/charlie.russel
>>
>>
>> "Rayasiom" <Rayasiom@discussions.microsoft.com> wrote in message
>> news:E7F1B65D-D7D4-4E54-AA6D-2BBFACDE65E3@microsoft.com...
>> > Hi.
>> > I need to block certain users in the office from accessing certain
>> > websites
>> > and specifically Live Messenger as they are abusing the system.
>> > I have Windows Server 2003 for Small Business Server SP2.
>> > How can I do this?
>>
>>

You can go into your DNSMGMT.MSC and add host records for the servers
you want to block that point to the local loop address 127.0.0.1.
This way, the users will be blocked after their DNS caches refresh.
You could also go on your firewall and add rules to block the
connection to those specific servers.

We have managed to find a way without having to do any costly upgrades or
additional purchases that involves going into the group policy on the server:

Go to Group Policy Management, Group Policy Object Editor (on created
Restricted Sites Policy), then path:
Computer Configuration
Windows Settings
Security Settings
Software Restrictions
Additional Rule c:\program files\messenger\msmsgs.exe Disallowed
C:\program files\msn messenger\msnmsgr.exe
Disallowed

I then did the same for User configuration and also added in Hash rules in
case the program was downloaded elsewhere.
BUT it would be nice to be able to allocate hours of business for the
restrictions.

"Medthump" wrote:

> You can go into your DNSMGMT.MSC and add host records for the servers
> you want to block that point to the local loop address 127.0.0.1.
> This way, the users will be blocked after their DNS caches refresh.
> You could also go on your firewall and add rules to block the
> connection to those specific servers.
>
>

How do I do that?
I thought I had solved my problem by adding a Path and Hash rule in the
policies, but the Windows Live Toolbar has been installed and allows access
to WLM once again!!!!

"Medthump" wrote:

> You can go into your DNSMGMT.MSC and add host records for the servers
> you want to block that point to the local loop address 127.0.0.1.
> This way, the users will be blocked after their DNS caches refresh.
> You could also go on your firewall and add rules to block the
> connection to those specific servers.
>
>