Why Restrict Internet Access via GPO?
In corporate environments, you may have specific user accounts—such as kiosk users, factory floor terminals, or generic shared accounts—that require access to the internal network but should be completely blocked from browsing the public internet. By utilizing Windows Server Group Policy, you can easily restrict outbound internet access by deploying a bogus proxy configuration specifically to those users.
Step 1: Create the Target OU
For this policy to apply correctly, the target users must be organized properly. Open Active Directory Users and Computers (dsa.msc) and ensure the users you wish to restrict are moved into a specific Organizational Unit (OU), for example, “Restricted_Users”.
Step 2: Create a New Group Policy Object
Open the Group Policy Management Console (gpmc.msc). Right-click your “Restricted_Users” OU and select Create a GPO in this domain, and Link it here…. Name the policy something identifiable, such as “Block Internet Access”.
Step 3: Edit the Internet Explorer Policy Settings
Right-click the new GPO and select Edit. Since we are targeting users, navigate to the User Configuration section:
User Configuration > Preferences > Control Panel Settings > Internet Settings
Right-click the empty pane, select New, and choose Internet Explorer 10 (this setting applies to IE11, Edge, and the system-wide Windows proxy settings).
Step 4: Configure the Fake Proxy
In the Internet Explorer properties dialog, navigate to the Connections tab and click the LAN settings button. Check the box that says Use a proxy server for your LAN.
For the Address, enter a non-existent internal IP, such as 127.0.0.1 (localhost), and set the Port to 80. Check the box for Bypass proxy server for local addresses.
Press F5 on your keyboard while the Proxy Server section is highlighted; the red underlines will turn green, indicating the setting will be enforced. Click OK twice to save the configuration.
Step 5: Apply and Test
The next time a user in that OU logs into a domain-joined machine, Group Policy will configure their system to route all web traffic to the local loopback address. Internal intranet sites will still work (due to the bypass setting), but any attempt to reach the public internet will immediately fail with a proxy error.
To test it immediately, log in as a restricted user, open Command Prompt, run gpupdate /force, and attempt to open a website.