+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 18
Wireless Networks Thread, Disable Internet using Groups in Technical; Hi, I've been trying for some time now to disable the internet for certain users. This is what I am ...
  1. #1

    Join Date
    Aug 2005
    Location
    Shropshire
    Posts
    292
    Thank Post
    17
    Thanked 11 Times in 8 Posts
    Rep Power
    21

    Disable Internet using Groups

    Hi,

    I've been trying for some time now to disable the internet for certain users.

    This is what I am doing (or trying to do)

    I have created a group in Active Directory Users and Computers simply called "No Internet" when teachers ask me to disable a pupils internet access, I make that pupil a member of the "No Internet" group.

    I then have a group policy setting which under User Settings and Internet Explorer Maintance sets the proxy server to a false proxy address so that the internet cannot work. I also have Internet Policy Refresh enabled and set to "even if no changes are made" This Group Policy is set to enforced and only to apply to the "No Internet" group

    If I log onto a workstation as a user who is a member of the No Internet group and do gpresult I can see that the Policy has been applied, but when I try the internet it still works and the proxy servers have not changed from the working ones to the false ones.

    I've never been able to get the Internet Settings to work in group policys, even to set things like the home page etc etc

    What am I doing wrong, or what else do I need to do to make it work (or not work as the case may be!!!)

    Regards,

    Matt

  2. #2
    mark's Avatar
    Join Date
    Jun 2005
    Posts
    3,966
    Thank Post
    248
    Thanked 49 Times in 45 Posts
    Blog Entries
    2
    Rep Power
    46

    Re: Disable Internet using Groups

    When you say "make that pupil a member" you mean you drop them into the no internet OU correct?

    Is the No Internet OU beneath the other student user OU's?

  3. #3

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Disable Internet using Groups

    90 minute delay on average before GPO settings are applied. Some settings are only applied on login/reboot too.

  4. #4

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,596
    Thank Post
    109
    Thanked 764 Times in 595 Posts
    Rep Power
    181

    Re: Disable Internet using Groups

    You should be using an authenticating proxy so that you can keep records of who is viewing what.

    By adding users to a security group called 'No Internet' and denying access to the net, there is no need to faff about with GPOs.

  5. #5

    Join Date
    Aug 2005
    Location
    Shropshire
    Posts
    292
    Thank Post
    17
    Thanked 11 Times in 8 Posts
    Rep Power
    21

    Re: Disable Internet using Groups

    There is no OU setup called "No Internet" The pupils all belong to the Pupils OU, I link the group policy that disables the internet to the Pupils OU but because I've removed the "Authenticated Users" from the Security Filtering section of the Policy in GPMC and added "No Internet" the policy only applies to members of the No Internet group, so I don't have to keep moving accounts back and to from different OU's (And I know that that bit is working correctly by running the gpresult command I can see that that particular policy setting has been applied to members of that group and not to anyone else)

    @ Ric_
    Nice idea, but we don't have a Proxy at the actuall school, it;s one all schools in our LEA access, so setting it up in that way is not an option I'm affriad.

    @Geoff
    I was aware of the delay to apply the settings, but I thought a "gpupdate" would sort that out, I also did a restart aswell

    Regards,

    Matt

  6. #6
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    5,009
    Thank Post
    120
    Thanked 282 Times in 260 Posts
    Rep Power
    108

    Re: Disable Internet using Groups

    What you are trying is a good idea but like others have said your going to have problems. Using a local proxy is usually the best bet as this offers some flexibility. Most of us have a local proxy that fowards to our county one and they are easy enough to setup even using old hardware.

  7. #7

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,596
    Thank Post
    109
    Thanked 764 Times in 595 Posts
    Rep Power
    181

    Re: Disable Internet using Groups

    @mattplant: Is the use of Smoothewall, Censornet, etc. not an option?

  8. #8

    Join Date
    Aug 2005
    Location
    Shropshire
    Posts
    292
    Thank Post
    17
    Thanked 11 Times in 8 Posts
    Rep Power
    21

    Re: Disable Internet using Groups

    OK,

    i'm going to look more into setting up a local proxy server, but I can't understand why what should be a simple Group policy setting to change the Proxy server setting for a user to a "duff" address and only apply to members of a certain security group should course so many problems?

    How do others send out Settings related to Internet Explorer, 'cos I like I mentioned in the first post, I've never been successfull. Even if I want to change the users homepage etc etc I've never got it to work

    Regards,

    Matt

  9. #9
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    5,009
    Thank Post
    120
    Thanked 282 Times in 260 Posts
    Rep Power
    108

    Re: Disable Internet using Groups

    Have a look at the like of Censornet and Smoothwall . A basic smoothwall setup will probably be easier than a Censornet one.

    Both are fairly easy to set up as long as you dont have any hardware they dont like. You will need a few extras for the user authentication on the smoothwall but thats all well documented on their forums.

  10. #10
    mark's Avatar
    Join Date
    Jun 2005
    Posts
    3,966
    Thank Post
    248
    Thanked 49 Times in 45 Posts
    Blog Entries
    2
    Rep Power
    46

    Re: Disable Internet using Groups

    I use the same proxy as you MP - and It works fine for me - blocking access, and setting favourites/ settings in IE too. I'm also looking at additional proxying, just for the added features it will give us. Censornet looks excellent.

    I don't see how you know which GPO takes precedence in that setup, and which policy is applied first - sounds like it's obviously the wrong one. But then why don't your other settings have any effect?

    All our pupils reside in a pupil OU. I have sub OU's for year groups, and sub OU's of those called no internet, with GPO applied, with just the proxy crippled. Drag users into that - job done. The censornet method would be far neater. The filtering element is not strictly necessary, but stuff like blocking access at group/ user level, and monitoring would be great.

  11. #11
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    5,009
    Thank Post
    120
    Thanked 282 Times in 260 Posts
    Rep Power
    108

    Re: Disable Internet using Groups

    The last group policy to be applied will be the one that is used for the setting.
    As for something you said earlier about setting the GPO to enforced Matt this just means it overides when an OU is set to block inheritance.

  12. #12

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Disable Internet using Groups

    I don't see how you know which GPO takes precedence in that setup, and which policy is applied first - sounds like it's obviously the wrong one. But then why don't your other settings have any effect?
    The GPMC will show whats going on here via its GP Results tool.

  13. #13
    ajbritton's Avatar
    Join Date
    Jul 2005
    Location
    Wandsworth
    Posts
    1,632
    Thank Post
    23
    Thanked 75 Times in 45 Posts
    Rep Power
    34

    Re: Disable Internet using Groups

    Have you configured your IE policy settings in 'preference' mode or 'policy' mode? If you are using preference mode, then the settings will not override the user settings.

    This may be of use.

  14. #14
    alan-d's Avatar
    Join Date
    Aug 2005
    Location
    Sutton Coldfield
    Posts
    2,414
    Thank Post
    360
    Thanked 256 Times in 187 Posts
    Rep Power
    75

    Re: Disable Internet using Groups

    does the toolkit IEAK6 allow you to do this?

    IEAK6

  15. #15
    woody's Avatar
    Join Date
    Jun 2005
    Location
    Carlisle, Cumbria
    Posts
    617
    Thank Post
    3
    Thanked 17 Times in 15 Posts
    Rep Power
    22

    Re: Disable Internet using Groups

    I have used the same method to restrict internet access to individual users. Two groups for each year (eg. year05 & year05-ie) Two GPs. The first GP named 'pupils' contains all policy settings for all users, but does not have a proxy configured. The second GP named 'internet' contains the true proxy configuration. All pupils are members of the first group 'year05' which applies the 'pupil' GP. When we want a pupil to have access to the internet, we add them to the second group 'year05-ie' which then applies the 'internet' GP.

    When we want to remove that access, we remove them from the group 'year05-ie'

    It works every time here but you do need to log off and on again for it to apply straight away. Plus you do need to get the GPs to be applied in the correct order.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Enable/Disable workstation internet access from shortcut
    By the_mighty_boosh in forum Netware
    Replies: 3
    Last Post: 28th January 2011, 09:34 AM
  2. Internet Filtering groups
    By steele_uk in forum How do you do....it?
    Replies: 4
    Last Post: 17th July 2007, 01:33 PM
  3. Unusual groups in AD
    By Kyle in forum Windows
    Replies: 3
    Last Post: 19th April 2007, 07:35 AM
  4. Censornet Groups
    By leon in forum *nix
    Replies: 7
    Last Post: 21st February 2007, 10:46 PM
  5. Mapping AD groups to Unix groups
    By localzuk in forum *nix
    Replies: 23
    Last Post: 11th February 2007, 08:57 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •