Backstory

I spent some time reading around http://www.edugeek.net/forums/internet-related-filtering-firewall/145867-google-moving-ssl-searches.html and Google's enforced moving all searches to SSL and the issues this was causing for Web Filtering. Fearing that our web setup would again force me to block Google searches, I read through and found, to my relief, that all would be well.

Or so I thought.

I have redirected our Google searches to enforce Google safe search, using the Google VIP

However, two pieces of information came together and made me realise that I needed to make a change to the network or face the possibility of uncomfortable questioning. The first was that Ofsted are asking questions about web filtering, with this specific issue in mind (google-moving-ssl-searches Page 5l

And secondly a post from @Irritable Tech Google-safe-search which reminded me that I had, in fact, only set the redirection to Google Safe Search for google.com and .co.uk as these were the only two domains that the students ever used. Of course, with BYOD, even with SECURUS onsite, I couldn't know for sure that students weren't using other domains for their searches on their phones or other devices around the school without Securus (iPads, tablets etc).

Then came the mammoth task of adding all 190 or so countries to my own DNS. I don't have a proxy filter, instead relying on our Palo Alto provided by Virgin, and the Web Filtering inbuilt therein. For the most part it does a good job, and with SECURUS backing it up, I'm sure it will pass any Ofsted/Child safety inspection. However, for all it's good things, it can't force Google safe search without the DNS 'hack', which I have to do on a local server.

I started entering them one by one, and figured it would take me the best part of a day, and thought there must be a better way. Command prompt could do it, but I figured that Poweshell would be the best bet.

Technical Bit - How to add lots of Forward Zones and Host A Records using Powershell

First up, I needed to know what commands would allow me to create Forward Look Up Zones - Technet - Add Zones to DNS via Powershell

In this case, I needed

Add-DnsServerPrimaryZone -Name "www.google.com" -ReplicationScope "Domain" -PassThru

Next, the code to create an A Host record Add-dns-a-records-via-powershell/

Again, the code required is

Add-DnsServerResourceRecordA -Name "." -ZoneName "www.google.com" -AllowUpdateAny -IPv4Address "216.239.38.120"

So, two pieces of script, now I needed a list of google domains - Google supported_domains

And to combine them all, I needed Excel. Paste the list of domain names into Excel, then copy them again, and this time paste - special - tick transpose to get a nice long list of domains. Place into Column B.

In Column A type "Add-DnsServerPrimaryZone -Name "www" and then in column C type "" -ReplicationScope "Domain" -PassThru" (without outside quote marks) Then in column E type =A1&B1&C1 This should mean, in column E, you'll get the text "Add-DnsServerPrimaryZone -Name "www.google.com" -ReplicationScope "Domain" -PassThru". Extend the series' in Columns A, B and E all the way to the bottom of the domain list. Then copy colum E, paste into Notepad and save it as 'DNSZones.ps1'. That's part 1 sorted.

Part 2 is similar, just in Column A make it "Add-DnsServerResourceRecordA -Name "." -ZoneName "www" and Column C "" -AllowUpdateAny -IPv4Address "216.239.38.120"" (again, without the outside quote marks). Extend the series and copy Column E into notepad and this time call it 'DNSAHost.ps1'.

If you're feeling brave, you can run the scripts on your DNS server, ensuring to run DNSZones first, then DNSAHost, but I would copy one line from each file first and run them as a test. All going well, you should have every Google domain covered and redirected to safe search.