I have surfed the internet and Experts Exchange and have not found the step-by-step way to accomplish this. I have found lot's of answers, but I am not good at creating GPO's or OU's so I need a little more assistance than the general tips I have found.
I have a SBS 2003 Std Domain/Network with XP/Vista clients.
I would like to restrict IE internet access for specific users on the domain to both our Intranet and a few specific external websites.
What is the best way for me to set this up?
Thank you!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
In addition, i normally use the GPMC, in case you are not familiar with this, i have added a link below where you can download the app and swat up on how to use it to deploy your group policies.
http://www.micros
Cheers
M
Thank you very much for the help. Can you walk me through installing the Group Policy for IE settings you first described.
I installed the GPMC that you gave me a link to, though from what I can tell, I already had it installed though I am not able to find a function/program called Group Policy Management Console.
If I go into Administrative Tools I am able to open "Group Policy Management" is this the same thing?
If this is correct, where to I put the new policy?
Hey,
I had started typing this up but had kinda forgotten how to do this :) So i found a link that looks to be quite helpful.
Please remember that your GPO's can be assigned / linked to an OU (Organisational Unit) instead of the entire domain if you wish. (Instructions also in the link)
http://technet.micros
Hope this helps!
Cheers
Michael Ian Claridge
Please note that once you have created a GPO, you can edit the policy settings via the "Settings" tab on the right hand side, it is here where you enter the below settings for your Group Policy Object.
User Settings --> Windows Settings --> Internet Explorer Maintenance --> Connection
Then open the Proxy Settings window and add 0.0.0.0 for port 80.
User Settings --> Administrative Templates --> Windows Components --> Internet Explorer
Then set Disable Changing Proxy Settings.
Cheers
MC
Hey there!
The OU will need to be created within Active Directory and will be visible within the GPMC once created :)
To create an OU within AD, simply decide where you wish to create it, right click the folder structure and select Organizational Unit (OU), give it a name and thats it :)
Cheers
MC
PS - And yes your assumptions are correct ;)
Thank you for the help.
I went into AD Users & Computers and made an OU. How to I add/move a user to that OU? How do I link the GPO to the OU?
I also noticed that when I was in the GPMC that if I right clicked my domain there is an option to create a new OU there also. What is the difference?
Thank you again.
Hey,
Its nearly 3am here so i'll be off to bed very shortly :)
It depends on how you want to move users to be honest, you can search for them using the find option, right click on the username and setelct move, this will then give you a little popup window of your Active Directory, all you then need to do is navigate to the folder and click ok. Alternativly you can just drag ond drop the user from 1 OU to the next. But i do find the serach option easier the larger your Active Directory gets.
Bearing in mind i haven't created a GPO for the last couple of years, however i believe you can drag it to the OU that you wish to link the GPO to and that will in turn create the link for you. try it and let me know how you get on.
If you right click you Domain and not any individual container the GPO will be applied to your entire domain, i believe this also includes DC's exchange Servers etc.
Anyways its sleep time now.
Hope this has helped :)
Cheers
Michael
Here are the details of what was done in order to attain this solution:
For SBS 2003 Server/Domain:
Create and Name a Group Policy Object (GPO):
Administrative Tools --> Group Policy Management --> Forest: domain.local --> Domains --> domain.local --> Group Policy Objects --> Right Click --> Select: New --> Name: IE Internet Domain Restrictions
Edit/Configure Settings on New Group Policy Object (GPO):
Administrative Tools --> Group Policy Management --> Forest: domain.local --> Domains --> domain.local --> Group Policy Objects --> IE Internet Domain Restrictions --> Right Click --> Select: Edit...
...Group Policy Object Editor Window...
User Configuration --> Windows Settings --> Internet Explorer Maintenance --> Connection --> Proxy Settings --> Properties --> Enable Proxy Settings --> Address of Proxy: 0.0.0.0 Port: 80
*You can add exceptions in the form of *.domain.com; *.domain.com; (* is a wildcard)
*Enable Do not use proxy server for local addresses if you want unlimited access to internal company websites
User Configuration --> Administrative Templates --> Windows Components --> Internet Explorer --> Enable: Disable Changing Proxy Settings
Create New Organizational (OU) Unit that will Link to / Use the GPO Settings:
Administrative Tools --> Group Policy Management --> Forest: domain.local --> Domains --> domain.local --> MyBusiness --> Users --> Right Click --> Select: New Organizational Unit --> Name: IE Restrict
Link GPO to OU:
Drag GPO "IE Internet Domain Restriction" (that you created located in Group Policy Objects Folder)
--> to -->
OU "IE Restrict" (that you created located in MyBusiness/Users Folder)
Enable/Link User Account to new GPO/OU:
Administrative Tools --> Active Directory Users and Computers --> domain.local --> MyBusiness --> Users --> SBSUsers
*Drag user(s) you want to apply GPO Policy --> to --> IE Restrict Folder
Once that user logs back in, the new policy will be in effect and will no longer be able to access the internet other than specified exceptions. WARNING: this affects not only Internet Explorer, but any software that uses .NET. If you have any software that needs to access the internet, make sure the websites that it accesses are part of the exception list.
Business Accounts
Answer for Membership
by: MichaelIanClaridgePosted on 2009-11-05 at 14:47:06ID: 25754950
Hey,
You could create a Group Policy for IE to use a bogus proxy such as 0.0.0.0:80 and restrict any users changing it.
The settings are as below:-
Then open the Proxy Settings window and add 0.0.0.0 for port 80.
User Settings --> Administrative Templates --> Windows Components --> Internet Explorer
Then set Disable Changing Proxy Settings.
Let me know if you need any help :)
Cheers
MC