Security Zones

[dberg35]

I have added some websites to AD GP security zones, but users can still get to the site...(myspace.com). The only things is they can no longer login. I was hoping for a full block, can this be done?

 

[lhuegele]

Here's what we did to block access to Myspace:

Created a new forward lookup zone in our internal DNS servers for "myspace.com" that we then redirected to a special web-page on our internal web server that explains to the user that access to the site is blocked by company policy. It also instructs them to contact the help desk if they feel that they reached the page by mistake.

Of course, this is not fool-proof but it got the job done for us.

Good luck.

 

[dberg35]

That is interesting never thought of that. Can I do that with multiple sites?

 

[lhuegele]

Of course! You would just create a new forward lookup zone for each domain you wanted to block. Works great for us, plus we get to monitor the number of people trying to access those sites because of the logs on our internal web server. Very snazzy!

 

[kmcferrin]

As for an explanation, the Security Zones settings in Group Policy are the same as the Security Zones in IE. Adding sites to the Restricted Sites zone doesn't prevent users from accessing the sites, it only means that whatever settings are applied to the Restricted Sites zone (i.e., don't execute .NET, Javascript, etc).