want to centrally control the restricted sites on a windows7 IE8 client in a 2008 R2 domain

i building new lab. want /need 100% microsoft products.
have years of experience in systems management struggling in client management areas.

the question
want centrally control restricted sites on windows7 ie8 client in 2008 r2 domain.

background.
have implemented dual nic isa server , configured accordingly.
have admit found pain , bit of dark art never quite mastered because once set never messed it. tried in 2008r2 domain , came across little quirks , peculiarities, articles , documents suggested isa in not supported in 2008r2. isa out picture.

2008 nap , nps seems way forward.
have been reading on over 2 weeks , still not sure solution investigate. did find out how secure wireless using nap , certificates , first shot @ working after fashion.

for ie clients i’ve got far thinking can use gpo machine / , user implement ie content  advisor policy.
see hurdle here in machine policy takes pres on user policy. approach have every machine banned xxx sites. , every default user banned else.
add granularity lifting blanket user ban users via ad  groups sites.
poking around , reading think can this. if correct way go.

one thing not sure of using option 1 lists / modifies lists/database of banned sites. , how 1 monitor/report on compliance attempted infringements of rules.

because of learnt when securing wireless going totally rebuild yet again (well roll vms actually) time id secure ie before wireless.

anyone care point me in right direction ?

 

thanks.

hi,

 if referring restricted sites zone in ie, not ban users or computers visiting sites, configured group of sites have higher level of browser security settings. list of sites in zone can managed via gpo using setting user configuration\administrative templates\windows components\internet explorer\internet control panel\security page\site zone assignment list.

 

 if goal prevent users browsing sites, proxy server way go. isa legacy product (which why doesn't support latest os). new product called forefront threat management gateway (tmg). if set tmg server domain member , use either proxy (by configure ie proxy on machines it) or firewall (by configuring default gateway of clients it) can configure rules prevent users accessing sites. need manually configure site list. if need dynamic list, can subscribe microsoft url filtering content service , block access sites using categories (http://blogs.technet.com/isablog/archive/2010/01/03/categories-for-url-filtering.aspx).

 

as far nap/nps, these technologies used validate settings on client machines before giving them access network. can require systems have current anti virus products, host based firewall enabled, etc before access network. not sure how apply in case.

 

if misunderstood goals, let me know.

 

thanks,

guy

Windows Server  >  Group Policy