Need help writing zone add/delete syntax with dnscmd

[ReK410]

My goal is to lift our block on Youtube during certain hours by using DNSCMD bat files to add and delete the zone via Windows Task Scheduler.

My create command seems to work OK, as soon as it is run the clients are immidiately blocked from the site:

dnscmd /zoneadd youtube.com /dsprimary

I'm having problems with the delete command. It runs sucessfully and I see via the MMC that the zone is no longer listed. However the clients are still blocked, even after I restart the DNS Server service.

dnscmd /zonedelete youtube.com /dsdel /f

Any ideas why?

 

[intelwizrd]

Have you tried clearing the cache on the client machines after the delete? Are the clients using this server for primary DNS or is there another server in between? Do you have more than one local DNS server that zone might be replicating to?

 

[ReK410]

I think it is a client-side issue because I tested a couple of machines and it wasn't consistent between them. That's annoying because it isn't something I can manage from the scripting :-(

 

[intelwizrd]

Do you have a linux box? I have squid running as a proxy server and squidguard running to restrict the access to certain sites like youtube and other problem sites during business hours. We also have different groups of IPs to allow for different policies between departments. It is fairly configurable, easy to install and I deployed the proxy settings to the users via a GPO in the domain.

A slightly different approach: if your users don't have custom entries in their hosts file, you can do this:
on a server or your workstation create a folder called "customhosts"
in the folder create two folders called blocked and unblocked
in those folders create a hosts file in each
in the blocked dir file add an entry that sends youtube.com to 127.0.0.1
in the unblocked dir file dont put it in
create a batch file to copy the hosts file to the machines for blocking and another for unblocking.

 

[ReK410]

Unfortunately we are a M$ Windows shop :-(

I'm thinking the same thing about the hosts file, it's just a tricky thing to deploy. We are considering blocking/unblocking multiple times per day so I'm trying to find a way that will work without the users needed to log out/back into their machines.

 

[intelwizrd]

Changes to the hosts file should be an instant change. May have to close and reopen the browser to get it to take effect (unless you disable page caching). The system hosts file is checked before DNS so you don't have to worry about the local DNS cache.