Disable Internet using Groups

[mattpant]

Hi,

I've been trying for some time now to disable the internet for certain users.

This is what I am doing (or trying to do)

I have created a group in Active Directory Users and Computers simply called "No Internet" when teachers ask me to disable a pupils internet access, I make that pupil a member of the "No Internet" group.

I then have a group policy setting which under User Settings and Internet Explorer Maintance sets the proxy server to a false proxy address so that the internet cannot work. I also have Internet Policy Refresh enabled and set to "even if no changes are made" This Group Policy is set to enforced and only to apply to the "No Internet" group

If I log onto a workstation as a user who is a member of the No Internet group and do gpresult I can see that the Policy has been applied, but when I try the internet it still works and the proxy servers have not changed from the working ones to the false ones.

I've never been able to get the Internet Settings to work in group policys, even to set things like the home page etc etc

What am I doing wrong, or what else do I need to do to make it work (or not work as the case may be!!!)

Regards,

Matt

[mark]

When you say "make that pupil a member" you mean you drop them into the no internet OU correct?

Is the No Internet OU beneath the other student user OU's?

[Geoff]

90 minute delay on average before GPO settings are applied. Some settings are only applied on login/reboot too.

[Ric_]

You should be using an authenticating proxy so that you can keep records of who is viewing what.

By adding users to a security group called 'No Internet' and denying access to the net, there is no need to faff about with GPOs.

[mattpant]

There is no OU setup called "No Internet" The pupils all belong to the Pupils OU, I link the group policy that disables the internet to the Pupils OU but because I've removed the "Authenticated Users" from the Security Filtering section of the Policy in GPMC and added "No Internet" the policy only applies to members of the No Internet group, so I don't have to keep moving accounts back and to from different OU's (And I know that that bit is working correctly by running the gpresult command I can see that that particular policy setting has been applied to members of that group and not to anyone else)

@ Ric_
Nice idea, but we don't have a Proxy at the actuall school, it;s one all schools in our LEA access, so setting it up in that way is not an option I'm affriad.

@Geoff
I was aware of the delay to apply the settings, but I thought a "gpupdate" would sort that out, I also did a restart aswell

Regards,

Matt

[ChrisH]

What you are trying is a good idea but like others have said your going to have problems. Using a local proxy is usually the best bet as this offers some flexibility. Most of us have a local proxy that fowards to our county one and they are easy enough to setup even using old hardware.

[Ric_]

@mattplant: Is the use of Smoothewall, Censornet, etc. not an option?

[mattpant]

OK,

i'm going to look more into setting up a local proxy server, but I can't understand why what should be a simple Group policy setting to change the Proxy server setting for a user to a "duff" address and only apply to members of a certain security group should course so many problems?

How do others send out Settings related to Internet Explorer, 'cos I like I mentioned in the first post, I've never been successfull. Even if I want to change the users homepage etc etc I've never got it to work

Regards,

Matt

[ChrisH]

Have a look at the like of Censornet and Smoothwall . A basic smoothwall setup will probably be easier than a Censornet one.

Both are fairly easy to set up as long as you dont have any hardware they dont like. You will need a few extras for the user authentication on the smoothwall but thats all well documented on their forums.

[mark]

I use the same proxy as you MP - and It works fine for me - blocking access, and setting favourites/ settings in IE too. I'm also looking at additional proxying, just for the added features it will give us. Censornet looks excellent.

I don't see how you know which GPO takes precedence in that setup, and which policy is applied first - sounds like it's obviously the wrong one. But then why don't your other settings have any effect?

All our pupils reside in a pupil OU. I have sub OU's for year groups, and sub OU's of those called no internet, with GPO applied, with just the proxy crippled. Drag users into that - job done. The censornet method would be far neater. The filtering element is not strictly necessary, but stuff like blocking access at group/ user level, and monitoring would be great.

[ChrisH]

The last group policy to be applied will be the one that is used for the setting.
As for something you said earlier about setting the GPO to enforced Matt this just means it overides when an OU is set to block inheritance.

[Geoff]

I don't see how you know which GPO takes precedence in that setup, and which policy is applied first - sounds like it's obviously the wrong one. But then why don't your other settings have any effect?

The GPMC will show whats going on here via its GP Results tool.

[ajbritton]

Have you configured your IE policy settings in 'preference' mode or 'policy' mode? If you are using preference mode, then the settings will not override the user settings.

This may be of use.

[alan-d]

does the toolkit IEAK6 allow you to do this?

IEAK6

[woody]

I have used the same method to restrict internet access to individual users. Two groups for each year (eg. year05 & year05-ie) Two GPs. The first GP named 'pupils' contains all policy settings for all users, but does not have a proxy configured. The second GP named 'internet' contains the true proxy configuration. All pupils are members of the first group 'year05' which applies the 'pupil' GP. When we want a pupil to have access to the internet, we add them to the second group 'year05-ie' which then applies the 'internet' GP.

When we want to remove that access, we remove them from the group 'year05-ie'

It works every time here but you do need to log off and on again for it to apply straight away. Plus you do need to get the GPs to be applied in the correct order.