Banning a website in group policy

[zag]

Is it possible to ban a certain website for a group of computers?

 

I need to ban youtube in our library but I don't think the current cachepilot proxy is capable of doing that so I need another solution.

 

Any ideas?

[plexer]

No.

 

Ben

[Edu-IT]

I didn't think AD was there for web filtering. Thinking out loud here but how about using the hosts file on the computer to direct YouTube to another website?

[zag]

I didn't think AD was there for web filtering. Thinking out loud here but how about using the hosts file on the computer to direct YouTube to another website?

 

Yeh already tried re-routing youtube.com to 127.0.0.1 via hosts file but it only seems to work when the local user is logged in.

 

When a domain user logs in youtube is correctly displayed.

[JonahIJ]

Are you going through a proxy? If so it might work if you set a new AD group up, and apply your usual proxy settings via GP to the group but with exceptions for the websites you want to disallow. Then just add the relevant users into the group.

 

Edit: Just noticed it's for computers rather than students, so you'd have to use some loopback processing as well and apply the new proxy settings to your library OU - no need for the additional group.

Edited February 3, 2011 by JonahIJ

[timzim]

Surely you've got some sort of firewall/proxy/filtering service at some point between your school and the internet? In which case you should be able to add the offending site to a blacklist.

[zag]

Surely you've got some sort of firewall/proxy/filtering service at some point between your school and the internet? In which case you should be able to add the offending site to a blacklist.

 

Yep I've got a cachepilot proxy that works ok.

 

But in this case I need to ban youtube on certain computers in a specific OU, not by user.

 

Basically I would like youtube to work everywhere but our library.

[zag]

Aha! thanks for the ideas, managed to acomplish it using Internet explorer "Content advisor" setting.

 

You can ban sites in there on a specific computer. You can also use group policy if your domain controller is running the same version of IE.

 

Does the job even if its a bit messy.

 

Restricting Specific Web Sites in Internet Explorer Using Group Policy

 

Edited February 3, 2011 by zag

[bossman]

@zag:

 

I'm not familiar with cachepilot but there should be some way of banning those IP addresses from accessing this particular site.

 

You could setup in the DHCP a reserved scope of addresses which these computers belong too and they would always remain in this group that you set up on the cachepilot.

 

Just an idea as I have said I am not familiar with it.

 

[dwhyte85]

I'd do 'Bypass Proxy for local addresses' and make *.youtube.com a local address, add this to the IE settings on GP and deploy to the OU (library comps).

 

My way is crud but works, avoid it if you can

[2097]

i did have a vbscript once that would copy a host file a login .. seemed to work for domain users ? so unsure why yours didnt above

[soveryapt]

Don't the cachepilots do AD integration? I've not got mine setup as yet, but the cachepilots / NED boxes provided by Lancashire allow AD integration so you can choose OUs to allow through and not to specific sites.

[sted]

if you do use a proxy and cant get to internet without one you could use the proxy exception list in ie settings somewhere. Put facebook in there and it wont look for it on the proxy so should fail