Revoke user access to Internet via Group Policy method

If your organization has specific rules about Internet access, odds are someone is going to have their access revoked at some point. When this does happen, it's best to make the process of revoking or restoring access as transparent and painless as possible.

I've seen several ways to do this, but one of the cleanest and most "native" (i.e., the one that makes the best use of existing functions within Windows) is a method that involves using Group Policy to enforce a novel restriction on the target user. The method sets the Internet proxy server for the user's system to a nonexistent proxy server and prevents the user from making any changes. The "proxy" is actually just the local host -- 127.0.0.1 -- so all proxy requests are redirected right back to the system that sent them.

Many third-party programs that attempt to access the Internet, whether for their own sake or to provide access for a user, can detect and make use of the Windows network proxy settings. They are the same settings as those configured in the Control Panel under Internet Options | Connections | LAN Settings. If these p

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Microsoft Group Policy Management Using Active Directory to manage Macs in a Windows environment Group Policy Object modeling simplifies network security Microsoft Group Policy Tutorial Is a Group Policy setting changing my user rights? Mastering account lockout values in Group Policy Group Policy Object security in Windows Deny access to Windows system properties with GPOs Advanced Group Policy for Windows Vista Windows Server 2008's Group Policy has faster searching and filtering Why don't I have proper Windows Server 2003 rights to open a GPO? Web Management Internet Information Services (IIS) sees big changes in Windows Server 2008 How to keep IIS logs from filling up your server hard drives A first look at Internet Information Services 7.0 When and how to use worker process recycling with IIS Fix app problems stemming from Firefox as default browser Control users' Internet access Raise Web server performance in Windows Server 2003 Remotely administer IIS with HTML tool INDEX.DAT tool helps admins see what users browsed in IE Improving Internet browsing performance Active Directory Administration Using Active Directory to manage Macs in a Windows environment Troubleshooting poor Windows logon performance in Active Directory environments Common Active Directory security oversights Scripting domain controller installations: A must for Server Core Taming the LSASS.exe process for Active Directory performance and security Troubleshooting Active Directory database errors Active Directory database basics: Performing an offline defrag Branch office security: Pros and cons of read-only domain controllers Tips for Windows domain controller optimization How to rebuild the SYSVOL tree when none exists in Active Directory

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Group Policy Object  (SearchWindowsServer.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

rograms can have their connectivity settings changed by the end user (as is typically the case with Firefox), then this proxy-blocking technique may not work.

However, this method can get more complicated with some third-party programs. For instance, Firefox can automatically detect proxy settings, but it is difficult to lock down these settings since Firefox uses a local preferences configuration file rather than a Registry entry that can be Group Policy-enforced. It is possible to lock down the settings without using Group Policy, but this approach is not very elegant and more or less begs to be circumvented with time. (There is not yet an officially supported way to integrate Firefox with Active Directory or Group Policy.) Therefore, this is something you only want to use when you can manage every aspect of the target desktop's applications.

More information from SearchWinSystems.com

Rate this Tip To rate tips, you must be a member of SearchWindowsServer.com. Register now to start rating these tips. Log in if you are already a member. DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.