Is there a way to stop access to certain sites in IE? (on a domain).

[ivwshane]

Ok I have a win2k server domain running active directory and I would like to add a site to "restricted sites" (which I can normally do in with each user by going into IE--> tools--> internet options--> security--> restricted sites--> sites).
I'm not running any kind of proxy and I would prefer it if there were no scripts involved so I'm thinking it would be done through GPO but I'm not sure exactly where and how to enter it in. All clients are win2k/XP.

I would like to do this so that I can restrict such sites as gator.com from popping up with it's damn "install me" windows!

Thanks for your help.

 

[topaz22]

a quick and easy way is to put these (among others) in your hosts file (in %systemroot%/system/drivers/etc/hosts):
that way, the name resolves to your own local loopback device.

127.0.0.1 www.gator.co.uk
127.0.0.1 www.gator.com
127.0.0.1 www.gator.ne

 

[Saltin]

You can use Active Directory group policy to do this.

Open the Active Directory Users and Computers MMC.
Right click either the OU you want to apply the policy to, or right click the domain name to apply the policy to all users in the domain.
Select Properties, then select the Group Policy Tab.
If you are applying the policy to the entire domain, you will see the default domain policy listed on the Group Policy Tab, select edit.
In the Group Policy MMC that appears, expand User Configuration>Windows Settings>Internet Explorer Maintainence>Security
In the right hand pane, right click "Security Zones and Content Rating" and select properties.
In the window that appears, select the "Import the current content rating settings" radio button under the Content Ratings Section.
Click Modify Settings
Click on the Approved Sites Tab.

From this tab you can approve or forbid any URL you like. The list here will be pushed to all users who log on to the domain, regardless of the machine that they are on.
Once you set the policy, users will have to log out and back on for it to take effect immediatlely, or after about 30min it should take effect automatically.

You can test it on a machine without logging on/off or waiting by going to the command line and entering
secedit /refreshpolicy user_policy

 

[ivwshane]

Thanks for the tip guys!

I knew there had to be a way to set it in AD, I guess I just didn't dig down far enough.

Thanks again!

 

[ivwshane]

Ok well it worked except it seemed to disable the ability to right click and do a "save as".

Does anyone have a reason for this?
I use "save as" alot so I've disabled the setting and everthing is fine but I want everything to work perfectly.

Any ideas?

 

[MedicBob]

The "save as" setting is in group policy settings also.

 

[ivwshane]

Thanks, I'll dig around for it.