internet_deny group

[luke.mccormick]

Is there a way I can add a user to a special group in active directory and deny and type of internet access to that user?

[FAT64]

You could deny them access to iexplore.exe.

[cluberti]

That would work, unless they had Firefox or Opera (or some other browser). The best way to do it is to put a proxy in place on your network connection. If you can force your users to only using IE, you could use an autoproxy script to deny users access to the internet via group policy - put all of the "non-internet" users into one OU, or create a group for users in an existing OU and filter a policy on that group's users to use the autoproxy as their proxy to the internet (the proxy would need to be configured to direct every protocol to 127.0.0.1).

http://technet.microsoft.com/en-us/library/bb496457.aspx

[luke.mccormick]

ok..thx for ideas.