Grant Access to Single Website

[nevets2001uk]

Is there an easy way to allow a user access to only a single website address from their PC using either GPO or a firewall configuration?

We access our web through a proxy which we don't control and have a workshop PC that needs to access a manufacturer website only. We don't want regular web access as work won't get done!!

Cheers,
Steve

Steve G (MCSE / MCSA:Messaging)

 

[ATLMatt]

Depending on the firewall, yes. Many commercial firewalls have the option of creating a white list based off an IP or MAC address. If that is the case with yours, it should be relatively simple.

If not, I'm not completely sure... you can use a fake proxy to effectively stop all internet access, but I think you would need an actual proxy server to limit it. A GPO wizard I am not, so maybe someone else can help with a non-firewall solution.

 

[Zelandakh]

You could give them a hosts file with the name and IP of that site (plus you'd need your internal servers) then do away with their DNS and then they can't resolve anything except the ones you've put in.

Pretty easy to bypass but only if you know what has been done.

 

[vacunita]

I second Zelandakh. Just edit the hosts file and put in the site you want them to access. Then remove their DNS settings from the network configuration options, and they won't be able to resolve anything other than the address you specified in the hosts file.

The only downside to this is: it may make logging into the domain server a painfully slow process if the domain server is managing the DNS, if not then you'll have no issues.

----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

 

[linney]

Restriciting users to a particular website
thread779-1439324

restict all websites, allow only *.mil ??
thread779-1460894

How to disable internet avccess except for few websites for any browse
thread779-1503919

 

[cdogg]

An easy way if you are using IE is to enable the content advisor. Paste the following code into Notepad and save the file as noaccess.rat:

((PICS-version 1.0)
 (rating-system "[URL unfurl="true"]http://www.microsoft.com")[/URL]
 (rating-service "[URL unfurl="true"]http://www.microsoft.com")[/URL]
 (name "Noaccess")
 (description "This file will block all sites.")

 (category
  (transmit-as "m")
  (name "Yes")
   (label
   (name "Level 0:   No Setting")
   (description "No Setting")
   (value 0) )
  (label
   (name "Level 1:   No Setting")
   (description "No Setting")
   (value 1) ) ))

Copy the file to C:\Windows\System32. Now import this rating system into content advisor using the "Rating Systems..." button under the General tab. Delete the RSACi entry that's in there by default.

This file blocks all internet and intranet access without checking for a rating system. Then on the Approved Sites tab you can choose which sites or domains to allow. When you set the password, fill in the "hint" field with text that you want end users to see when they try to access an unapproved website (i.e. Please call the helpdesk at ext ***).

Of course, if users have admin rights on the PC they can eventually find a way around this such as installing another browser. I just like it because it's a quick way to configure the message prompt that is displayed to the user.

~cdogg
"Insanity: doing the same thing over and over again and expecting different results." - Einstein
[tab][navy]For posting policies, click [/navy]here.