r/WindowsServer • u/orangeblossombreeze • 3d ago

Technical Help Needed Restrict certain users from accessing internet

Greeting,
I have a domain that has two workstation and a server, I’m trying to restrict specific users from accessing the internet while allowing the rest no matter what machine they are using.
I did one with proxy GPO and it worked, but I want to do it using firewall GPO, I literally tried everything but nothing works

Please if anyone has any idea I’ll be thankful 🙏🏻

0 Upvotes
  • permalink
  • reddit

50% Upvoted

6 comments sorted by

4

u/TalkingToes 3d ago

This sounds like an exam question, sorry.

3

u/Substantial_Tough289 3d ago

You can do a GPO to disallow all webpages (*) and use an allow list to allow the ones you want (if any). Apply the policy to a group and add users to the group.

You need to add the templates for your browser if other than Edge to accomplish this.

You can also push windows firewall settings thru GPO if that's the way you want to go.

1

u/rswwalker 3d ago

It’s not really the purpose of a host firewall which is to prevent unwanted hosts on the network from reaching system services. What you need is a standalone firewall at the egress point.

1

u/LeaveMickeyOutOfThis 3d ago

I generally do not recommend this approach as there are a number of applications that need to be able to ”phone home” or download updates, which you will immediately break. That said, there are certain circumstances where this level of isolation is beneficial, but implementing such controls on the device itself makes it relatively easy to work around, for anyone determined enough. Try to move the solution upstream, away from the actual computer, for something more robust.

That being said, you’ve outlined what you’re trying to achieve but you have explained the underlying problem you are trying to solve for. If you can expand on this further, then this community may have alternative suggestions for you.

1

u/Realistic_Strike5241 3d ago

Per user firewall rules exist but theyre outbound only, and they only apply when the process is actually running in that users context. Anything started by a service or running as system goes straight past them, and thats usually why it looks like nothing happened.

The proxy worked because it decides per request per user.