I need help using GPO 1

[techwomantoo]

I work for a school district and I have some kids that have lost their right to access the internet. I use MS Win 2003 Server and created the group "no internet access" then I set the proxy to a fake address on a different subnet and then add bypass proxy for intranet use BUT it doesn't work! what am I doing wrong? Is it the port number? Are there two areas called Proxy settings? All suggestions are welcome.

 

[JimWells]

Did you set this under the Internet Explorer Maintenance section?

Also -- setting this proxy only restricts access from IEXPLORE.EXE. The explorer shell/Windows Update shortcut/etc. might still be able to get out - I don't recall.

At any rate, a non-MSTF browser or HTTP application (not to mention any non-browser app) will still be able to get out. This GPO trick just makes it harder for them to.

If you really need to lock down web access, you need to do some kind of Content Filtering between the LAN and your internet gateway.

 

[techwomantoo]

Yes, I set this under the Internet Explorer Maintenance Section. I only need to restrict a group of kids from internet access but the still need to use the intranet and a program called Plato that is lan based so I don't think content filtering will work. Its the user not the computer I need to stop. Thank you for your assistance!

 

[JimWells]

Content filtering doesn't mean that you would restrict them from intranet applications, nor that you couldn't get certain programs to work.

I mention it only because I've tried and have seen others try to limit net access in labs and made themselves crazy -- because there are limits on what you can do with GPO to make this happen.

So with the current IE setting -- IEXPLORE.EXE can get out to the internet and browse?

Is anything greyed out in the Internet Options menu on the locked-down users' desktop? (you should probably be locking them out of all of it, anyway).

Just to test, you might also try setting the proxy to 127.0.0.1 instead of something else. That's the one address you KNOW won't be running an HTTP proxy on your client machines...

 

[techwomantoo]

How do I use content filtering per user instead of per computer?

 

[JimWells]

Content filtering solutions that can be implemented per-user would generally require some kind of client to be installed on each computer; you would then put in a username/password, or (with good products) have that client check with an NT group membersip, RADIUS server, etc. to see if the logged in user has permission to bypass the content filter.

Larger content filtering products should all have something like this. (Look into Websense, Computer Associates' eTrust, WatchGuard appliance firewalls, etc).

 

[techwomantoo]

OK, got it. Thanks!