Windows server 2003?

Question

Hi does anyone know how to block internet access on certain computers running off a server. I work for a small company with about 10 pc's running off a main server. We all have internet access but am getting tired now of telling my young assistant to get on with some work and stop talking to his mates on msn.

I have admin rights on the server and have had a look in server management but can't seem to find anything. Have had a look on our router but there doesn't seem to be anything in there where I can restrict his IP address.

I can't disable his lan connection as this would mean he couldn't access the server for company info. Oh, and unticking msn in windows firewall doesn't stop it connecting.

Please don't say to get rid of the assistant, he's only young and anyone reading this who chats constantly on msn whilst being paid then bear in mind how you would feel if you was the boss.

Thanks everyone for your answers. Will see what I can do next weeks. Thanks

Answer 1

Try this:

http://support.kerio.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=366&nav=0,2

Answer 2

Windows 2003 server unless it is the small-business edition, doesn't have a built in proxy. This will have to be installed separately whether you go with Microsoft ISA server or a third party such as Kerio's Winroute for example. Unless your router is somewhat outdated, I'm surprised you cannot create a policy to block MSN and other chat protocols or ports. MSN does function on port 1863 as well as over HTTP (port 80). My suggestion is to check the manufacturer for firmware updates and or manuals to verify that such policies cannot be implemented

Your other option as suggested is to implement Group Policy Objects. Keep in mind that when creating GPOs, different levels of the domain structure will enforce and inherit the policies differently. Unless you want to make this a standard policy for everyone, which are domain or site enforced policies, it is best to create Organizational Units (OUs) to which you can isolate the groups of users or computers you want this policy to be enforced onto. Also, GPOs at an OU level take precedence over domain and site policies unless specified not to be overridden. The link below should give you some idea of how GPOs work and it does make reference to Windows Messenger at some point. The only difference is that it is making reference to Group Policy on an indivdual computer, not an Active Directory Setting. Within Active Directory, You would go to:

Start menu -> Programs -> Administrative Tools ->
Active Directory Users and Computers.

You would then open a domain, exposing its OUs. Right-click the OU, go to its properties and you should be give the ability to manage the GPO of that OU.

Answer 3

There are a few ways

Active directory with group policy can block it installing/running

If yourrouter supports it, you can do a port block on Yahoo port 5050, webcam port 5100,
MSN Messanger port 1863.

Or
Tell the young man, this is a work place, do work or get fired as a warning

I personally perfer the 3rd option as I am a consultant playing the good guy, let the managers be the bad one :)

Answer 4

sweeet..

if you familiar with server 2003, you can restrict the software (msn messenger) from running...
you can do this from policy setting...

in fact you can write a white list, so only certain software in the list that can be run by your asistant user logon..

Answer 5

write a GPO( group policy object) on the active directory.
I think, just a suggestion.