Restrict internet access but allow certain sites - GPO

[thegrassisgreener]

is it possible to allow internet access to certain websites via GPO????

Our LEA policy says when a full internet connection is available students must be supervised.

We want a policy where by when there are not supervised (for example dinnertime) they can only access sites which are selected?

cheers

[Joedetic]

If you have something like MS ISA server you can specify usergroups in the AD for which you want a rule to apply to. You can also specify time frames and particular groups of computers etc.

So what you'd do is setup a rule to block all sites except the ones you want them to use, and have it to come on at a the times you want it to apply. You would stick that above the rule for your normal allow internet rule i /think/ so it takes a higher priority. It's been a couple of years since i played with ISA so details might be slightly wrong, but it can do it.

[maniac]

If you don't normally use a proxy server, you can do this by setting the proxy server on the workstations to a non-existant server (so they get nothing when the try and access pages) then put in the selected sites under the 'do not use proxy server for these addresses' section, this will allow access to them.

This is what we do for for students who are banned from the internet here, they get access to the VLE, student intranet and school website only. It's not the best solution, but easy to do using GPO, and it works.

Mike.

[Michael]

Alternatively you could use the Windows Hosts file and block the more common websites you don't want users to visit during lunchtime.

You could enable/disable the Hosts file using a logon and logoff script:

Logon
cd C:\WINDOWS\system32\drivers\etc && ren hosts.disable hosts

Logoff
cd C:\WINDOWS\system32\drivers\etc && ren hosts hosts.disable

Problem is, there's no method to automate this time wise and as far as I'm aware, wildcards like *.com do not work with a Hosts file.