Block Internet for Security Group 1

[andyds]

I have many security groups that use a single GPO to lock them down.

I want one of those security groups to be blocked from using Internet Explorer. I don't however want to create a new GPO to block them.

Any ideas how I could do this so the other groups are not affected?

 

[markdmac]

Well you need to specify if you want to block IE use or block Internet use. Your problem description and subject are in conflict.

To block Internet use is simple. Use a GPO and set a fictitious Proxy Server. This will prevent users from accessing the Internet while enabling them to still access your intranet.

Your statement that you don't want to create another GPO seems irrational to me. Take a look at my GPO FAQ. faq329-6116

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[andyds]

How do I copy my existing GPO then. Copy it to a new OU so I can block IE?

 

[markdmac]

You do not say if you are using Windows 2000 or Windows 2003. How you do it would be slightly different.

I would suggest using GPMC. It is easy to LINK a GPO to many locations that way. No need to actually copy them.

However GPOs CAN be copied. So for the academics of the question the easiest way is to create a new blank GPO. Then delete the contents of the folder in the
WINDOWS\SYSVOL\sysvol\domainname\Policies\GUID folder and copy the contents of the other policy into this location.

Identifying the GUID of the new folders can be easily done in GPMC on the details page. Or by clicking to open/browse the login scripts and navigating UP the directory tree from that point.

GPMC also has methods for backing up and restoring GPO settings.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[markdmac]

Also you have again stated block IE. Is that your intention or is it to block Internet use?

Blocking IE is accomplished by setting the value of iexplore.exe in the policy "Do not allow these applications" or is it "Do not run these applications" either way I guess I am paraphrasing since i don't recall the exact text and don't have access to my server at the moment.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript