Security Zones and Content Ratings GPO

[jimmy09]

Hi guys, I am new here. I am an IT Technician for a Residential Treatment facility and school. I am trying to lock down our residents where they can only go to 2 websties and those 2 only. I am trying to do this via GPO, I have messed with the Security Zone and content ratings, but I have the issue that some of our staff use the same computers as the residents, so when the log in, they are also getting the restriction. I have added just the residents to the Security Filtering section and took out the authenticated users. I am at a loss right now on what else to try. I have it applied to a OU where I only have a test resident account to verify it works(which I am only applying the GPO to that OU.)

 

I followed the following instructions and have been searching everywhere for a solution.

 

Restricting Specific Web Sites in Internet Explorer Using Group Policy :: Authentication, Access Control & Encryption :: Articles & Tutorials :: WindowSecurity.com

 

Any help would be greatfull!!!

 

Also we are running 2008 R2 and have windows 7 clients.

[Michael]

Have you considered a free filtering option such as OpenDNS? It's very good for this sort of thing.

[jimmy09]

I have thought about it, but how would OpenDNS know the difference if it is a staff or a resident?

[Michael]

From memory I think you can override by entering a password (if you're a staff member), but I may be thinking of something else. I suppose another consideration is different VLANs or your own proper internal filtering solution. I suppose it also depends on your budget also.

[jimmy09]

I would prefer to get it done via group policy if I can. I like how it is implemented. I just need to make sure staff don't get restricted. Right now it seems to me like after the test resident logs off (which is in the test OU that the Policy is linked) and a staff from a completely different OU logs in, they still are restricted. It seems that the GPO is not user based even though everywhere I read it states that it is.

[jimmy09]

Anyone? I really need this to work. Our Sonicwall is not catching everything.