Looking for a DNS answer....

[detroit]

Here's what I want to do, hopefully someone has an answer....

I currently have 2 dns servers setup in our domain. It is setup as active directory, so basically, both DNS servers are the same.

Since DNS has to be on every workstation, everyone gets internet access.

What I would like to know is, is there a way of setting up 2 DNS servers, that are identical, but if a name is not found, do not go out to the internet to resolve. I want 1 server to be used for people that are supposed to have access to the internet, and 1 for the people that are not supposed to have access to the internet.

Can this be done setting up 2 standard primary servers?

Thanks

Detroit

 

[breader]

If you're trying to deny access to the internet for certain people. I think you'll find that the easiest way is to deny it at the Firewall or Proxy.

 

[detroit]

Unfortunately, to do this at a Firewall level for over 200 users would get to be a pain. Proxy is not available anymore, so the next cheapest way would be to control the DNS entries for the workstations.

Detroit

 

[FaiTHLeSS]

Microsoft ISA Server?

 

[breader]

well I know I just created an Internet group. Added members to it. Allowed it alone permission to the Internet on my ISA Server.

 

[philote]

You could just make sure the computers that shouldn't have internet access are set up with an incorrect default gateway. As long as all your computers are on the same subnet this should allow them to access your network but not the internet.

Unfortunately I don't know if there's a good way to do this if you're using DHCP.

 

[detroit]

Unfortunately, I don't have the dollars to spend on ISA Server.

As for the option of an incorrect gateway, can't be done as we have 7 sites and they all need a correct gateway....

Any other solutions?

Detroit

 

[ccsscotland]

Hi

Are these 2 servers in the same domain? Or is one a child domain off of the forest root?

Have you thought of DNS forwarders or GPOs?

Regards,

Gaz

 

[detroit]

Both would be on the same domain, in the same location.

Can you elaborate on the DNS forwarders and GPO's?

Detroit

 

[ccsscotland]

Well...

As this is the same domain, you might be able to set a domain GPO that would allow/restrict certain users access to the internet. That could get rather messy, there is a utility that you might want to look at here:

http://www.codework-systems.com/bcontrol/features.htm

G