Block Internet, At Lunch, Specific OUs.

[RichCowell]

Windows 2008 Domain

ISA Server 2006 running on Server 20003

XP Workstations

 

I'm looking to block the internet access based on OUs at set times - mainly lunch, I know the internet can be blocked at set times easily using ISA Server, but can't find a way of doing it for specific times, e.g. our lunch time is 1315-1415

 

I'd rather use ISA if anyone can suggest away around its rather restrictive hourly slots...

 

Keen to hear any/all suggestions

[James2k]

Are you trying to block users or machines?

[RichCowell]

Machines, so all users on machines in set rooms/OUs are unable to access the internet.

[James2k]

Are the pupils going to be allowed to use the internet in certain rooms? or none at all?

 

As if they are not allowed to use the internet in general in them times. you could disable internet for all the pupils with one rule?

 

Edit:-

 

Do you have any classroom management software?

[RichCowell]

Are the pupils going to be allowed to use the internet in certain rooms? or none at all?

 

As if they are not allowed to use the internet in general in them times. you could disable internet for all the pupils with one rule?

 

Edit:-

 

Do you have any classroom management software?

 

Hiya

 

Yes, the pupils are allowed to use the internet in some rooms, but we're having trouble with teachers allowing them pretty much unsupervised access despite frequent instructions to the contrary...

 

We've got Ranger in the IT Suites, but not the room in question, and it seems a lot of expense for something ISA should really be capable of...

[glennda]

On isa,

Add the computers to a group then block the group access to the internet with a condition of a schedule that you set up in the toolbox, never tried it with blocking email but its how we set up our vpn to only work outside of school hours

[James2k]

On isa,

Add the computers to a group then block the group access to the internet with a condition of a schedule that you set up in the toolbox, never tried it with blocking email but its how we set up our vpn to only work outside of school hours

 

Don't you need the IP Addresses to do this?

[RichCowell]

On isa,

Add the computers to a group then block the group access to the internet with a condition of a schedule that you set up in the toolbox, never tried it with blocking email but its how we set up our vpn to only work outside of school hours

 

The time slots available are too restrictive though, they're set to hourly blocks, rather than custom time - I'd like to set it for 1315-1415, but to cover that I'd need to do 1300-1400 or 1300-1500 either way would interfere with lessons...

 

I'll probably have to leave it for now or implement another filter...

[glennda]

Don't you need the IP Addresses to do this?

 

If the pc's are part of a security group which you can add the pc's to then you can apply to only that group.

 

@Rich

 

I didn't think break might be odd hours!!

[James2k]

Have you thought about looking into another Classroom management solution?

 

ABTutor is rather cheap. And you can get away with only buying 1 license.

 

Then you could have the rooms in question that need to be blocked and do it as and when?

[RichCowell]

Have you thought about looking into another Classroom management solution?

 

ABTutor is rather cheap. And you can get away with only buying 1 license.

 

Then you could have the rooms in question that need to be blocked and do it as and when?

 

I'll look into that, thanks

[BatchFile]

What else does the server do? how about putting the time back 15 mins?????

 

(only half joking!)

 

EDIT: It won't work, and AD won't like it so don't (sorry )

I wouldn't recommend it if it's your SIMS SQL server as well...

 

Edit2: +1 for ABtutor - you only buy the tutor licences, clients are free - about £100 iirc

Edited February 8, 2010 by BatchFile
I made a suggestion I realised was silly

[James2k]

I'll look into that, thanks

 

£199 for one license and the more you buy the cheaper each one is.

 

They do a 30 day trial.

 

So you won't have to spend anything if you don't like it.

 

Been using AB Tutor here for nearly 2 years from using NetSupport (old version) it is a much nicer system.

 

And the upgrades are cheap to. Normally iirc 25% of normal cost per license.

[RichCowell]

I've just realised that like the Ranger, ABTutor will only work when done manually, which will rely on someone enabling and disabling it every day, which won't work, as I'm never in the same place twice at the moment...

 

I'll get there...

 

Thanks all

[James2k]

You can schedule in AB Tutor but it is in 30 minute slots. You can suggest things like this with the developers. As it is definitely something that will help a lot of people

[mac_shinobi]

Just wondering as never done it myself nor used them but curious if it would be possible to have 2 pac files

 

one pac file where if it is between certain times on the server or client then it wont allow access and would point them to an IIS Server with a blocked page or it would just give them duff proxy settings and then revert back to normal settings after that period of time

 

The other pac file just giving them relevant proxy settings.

 

Found this site which seems to have a number of different options - have not had time to read it but may be one or two useful things in there hopefully

 

http://michaelellerbeck.com/2009/04/14/chapter-3-the-internet-lockdown/

Edited February 9, 2010 by mac_shinobi

[Ric_]

Similar to the mac_shinobi solution, you could script the proxy settings for startup, applying one registry patch most of the time and during the specified hours, duff settings. This of course relies upon the little darling logging on between those hours.

[RichCowell]

Similar to the mac_shinobi solution, you could script the proxy settings for startup, applying one registry patch most of the time and during the specified hours, duff settings. This of course relies upon the little darling logging on between those hours.

 

That sounds like a great simple option... I'll look into it (though I'm no expert when it comes to scripting! lol)

 

Thanks Ric (thanks to everyone for your suggestions too )

[mac_shinobi]

That sounds like a great simple option... I'll look into it (though I'm no expert when it comes to scripting! lol)

 

Thanks Ric (thanks to everyone for your suggestions too )

 

https://calomel.org/proxy_auto_config.html

 

timeRange(hour1, hour2)

 

• hour is the hour from 0 to 23. (0 is midnight, 23 is 11 pm.)
  
  
• min minutes from 0 to 59.
  
  
• sec seconds from 0 to 59.
  
  

timerange(12)

true from noon to 1pm.

timerange(12, 13)

same as above.

timerange(12, "GMT")

true from noon to 1pm, in GMT timezone.

timerange(9, 17)

true from 9am to 5pm.

timerange(8, 30, 17, 00)

true from 8:30am to 5:00pm.

timerange(0, 0, 0, 0, 0, 30)

true between midnight and 30 seconds past midnight.

 

As per the bottom of the linked page - you can do time ranges / dates ranges etc but not sure if you can force a log off some how so that the pac re applies when the log back in between the 2 time periods

[RichCowell]

https://calomel.org/proxy_auto_config.html

 

 

 

As per the bottom of the linked page - you can do time ranges / dates ranges etc but not sure if you can force a log off some how so that the pac re applies when the log back in between the 2 time periods

 

Is that just for Firefox? :-s We're only using IE here... Not looked fully, saw the title and skimmed the rest.

[mac_shinobi]

Is that just for Firefox? :-s We're only using IE here... Not looked fully, saw the title and skimmed the rest.

 

That was a full page on how to do pac files with examples and I was just reffering to the end part which refers to the time range but pac files should work on firefox and internet explorer - not sure about safari or other browsers though.

[Ric_]

See How to configure client proxy server settings by using a registry file for how to change the proxy settings with a reg file. My mind has gone blank on the time checking bit you will need it as part of your logon script.

 

Don't forget to remove your proxy settings from your GPOs

[RichCowell]

See How to configure client proxy server settings by using a registry file for how to change the proxy settings with a reg file. My mind has gone blank on the time checking bit you will need it as part of your logon script.

 

Don't forget to remove your proxy settings from your GPOs

 

Cool, thanks

[57chevvy]

I've just realised that like the Ranger, ABTutor will only work when done manually, which will rely on someone enabling and disabling it every day, which won't work, as I'm never in the same place twice at the moment...

 

I'll get there...

 

Thanks all

 

Hi,

 

If you use a Ranger react task in LANRanger you can get it to block an applicaiotn in a "room" automatically for a period and then relase at a certain time.

 

 

Rgds

[mac_shinobi]

Impero

 

Impero Solutions Ltd - Network Computer Management and Monitoring

 

You can assign a computer for teachers use and let each teacher of each classroom manage / block / unblock internet access etc etc