Locking down internet access based on user login

[adtrance]

We run an AD environment (Server 2003 SP2) with several hundred workstations. Most of these workstations are assigned to particular users. There are GPO's running but for the most part, users at their workstations can go anywhere they need to on the internet. We do have a few 'problem' users who I'd like to lock down their internet access.

My question: is there a way to lock down internet access based on a user's login?

I don't employ roaming profiles, all profiles are created when a user logs onto the workstation for the first time and all data saved are stored locally on that station. All workstations are Windows XP SP2/SP3.

*edit* Just to be clear, is there a way to lock down internet usage such that no matter which workstation they go to, they receive this lock down process.

 

[MagnusTheBrewer]

Create a new user group and move them to it. Problem solved.

 

[adtrance]

There doesn't seem to be a simple way of adding users to an OU. An OU is the only way I can attach a GPO without running into WMI scripting.

 

[VinDSL]

Originally posted by: adtrance
We do have a few 'problem' users who I'd like to lock down their internet access.

If it's only a few users, I would put K9 on their machines...

http://www1.k9webprotection.com/

 

[yinan]

ISA Server can also suit this task.

 

[imported_snikt]

Originally posted by: adtrance
There doesn't seem to be a simple way of adding users to an OU. An OU is the only way I can attach a GPO without running into WMI scripting.

You should be able to just move the users to the new OU with a new GPO. Right-hand click on the user's account and select 'move'.

I didn't test this extensively, you'll have to do that if you decide to try it. It might work provided you don't have any proxy servers set up. Also, it might interfere with any apps. or Intranet that uses the protocols that will need to be configuredt. But I noticed in the GPO:

User Configuration > Windows Settings > Internet Explorer Maintenance > Connections > Proxy Settings

Try setting the proxy server for all the listed protocols to the loopback address: 127.0.0.1

Again, you'll have to test it extensively to see if it suits your needs.