#189270 - 2008-08-25 11:38 PM
Logon script to change proxy settings in a windows 2k3 domain
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
Hi everyone,
I have a windows 2003 domain with about 270 users who logs onto the domain to work. Now everybody have access to the internet once they log on. Now this is what management has asked me and my team to do:
1. to restrict some users from browsing at all times
2. for some users to be able to browse only at specify times only.
I can afford an ISA server now so i am looking at a complete logon script that will change the proxy settings for the users in an AD group (i called it IERESTRICT)when they logon and also look at the time of the day and allow those who can browse at that time access to pass traffic.
i hope i can get some help with this one please. Thanks in advance.
|
|
Top
|
|
|
|
#189271 - 2008-08-26 12:50 AM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: ekainyah]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
sorry guys i mean i can't afford an ISA server now.
|
|
Top
|
|
|
|
|
#189279 - 2008-08-26 02:34 AM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: Gargoyle]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
|
You really need to set this with a GPO and not a login script, otherwise the users can simply change the proxy settings at will. Also, without a proxy, exactly how do you plan to control access?? Do you have an existing proxy? If so, is it single leg or pass-thru? Single leg proxies are easy to bypass unless you incorporate specific rules to block web access in your routers.
ISA is one of the few firewalls that integrates with AD, so you can define access by group. I'm not sure about squid's current capabilities - been years since I played with it. IPCop is another firewall/proxy, but again, I don't know about user auth capabilities.
ISA shouldn't be a hard sell, since it can be your Internet firewall, proxy, and application publishing system all in one. Considerable cost savings over a "hardware" firewall and much more secure, since traffic never "passes through" an ISA firewall (unlike traditional firewalls that "open ports" to allow traffic "through" the firewall.
I use two ISA firewalls in my office to provide a screened subnet where our WiFi gateway lives along with our mail relay and public web farm. The back firewall is an Enterprise version that publishes two internal apps and our VPN. It also controls access between the workstation LAN and the server LAN segments.
Glenn
_________________________
Actually I am a Rocket Scientist! 
|
|
Top
|
|
|
|
|
#189302 - 2008-08-27 05:49 PM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: Witto]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
hi guys, the use of GPO works fine with fake proxy but the problem that i had was after testing with a user in the restricted group (which worked find)bu when i took the user out of the restricted group he couldn't browse because the proxy settings were still active in the connection. any idea how to get it off?
|
|
Top
|
|
|
|
|
#189306 - 2008-08-27 07:03 PM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: ekainyah]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
and i have to manually remove the proxy when i took the user from the Restricted group (OU) which should be the case. standing by.
|
|
Top
|
|
|
|
|
#189315 - 2008-08-28 09:34 AM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: ekainyah]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
Glenn,
can you please direct me to the procedure to use the GPO (the unrestricted) to expressly unset the settings defined by the restricted GPO? And also with the refresh time procedure please.
|
|
Top
|
|
|
|
|
#189316 - 2008-08-28 10:07 AM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: ekainyah]
|
Mart
KiX Supporter
Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
|
....
Periodic Refresh Processing.
Group Policy is processed periodically. By default, this is done every 90 minutes with a randomized offset of up to 30 minutes. You can change these default values by using a Group Policy setting in Administrative Templates. Setting the value to zero minutes causes the refresh rate to be set to seven seconds.
Setting a short refresh interval in a production environment is not recommended. This is because a policy refresh causes the Windows shell to be refreshed, which in turn causes all open shortcut menus to close, a brief flicker of the screen, and so on. In addition, it causes computers to contact domain controllers more frequently, increasing the load on the domain controllers. However, setting a shorter interval may be useful in test or demonstration scenarios.
To change the policy refresh interval setting, edit the Default Domain Controllers Group Policy object, which is linked to the Domain Controllers organizational unit. The Group Policy Refresh Interval for Computers setting is located under Computer Configuration\Administrative Templates\System\Group Policy node.
For domain controllers, the default period is every five minutes. Group Policy Refresh Interval for Domain Controllers setting is available under Computer Configuration\Administrative Templates\System\Group Policy node.
....
Group Policy Processing
You should create a GPO that sets the correct proxy for all systems that are allowed access.
_________________________
Mart
- Chuck Norris once sold ebay to ebay on ebay.
|
|
Top
|
|
|
|
|
#189529 - 2008-09-08 11:39 AM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: Mart]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
guys,
i am using the script below for this same IE restiction job that i saw somewhr. Apart from the If INGroup that successfully map the drive, the rest of the script (supposed to input fake proxy for the user if he/she is in that group) doesn't work. what possibly am i doing wrong that is preventing that portion not to work. Help please.
If Not @LogonMode
Break On
Else
Break Off
EndIf
Dim $SO
$SO=SetOption('Explicit','On')
$SO=SetOption('NoVarsInStrings','On')
$SO=SetOption('NoMacrosInStrings','On')
$SO=SetOption('WrapAtEOL','On')
Dim $NoCache, $x
$NoCache = DelKey('HKCU\Software\KiXtart\TokenCache')
If InGroup(@Domain+'\IE Restricted')
use Z: /DEL /PERSISTENT
use Z: "\\wgs-it005\departments"
Dim $Key1, $Key2, $Set,
$Key1 = 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings'
$Set = WriteValue($Key1,"ProxyServer","proxy:80",REG_SZ)
If @ERROR 'Error updating key [ProxyServer] : ' + @ERROR + ' - ' + @SERROR ? EndIf
$Set = WriteValue($Key1,"ProxyEnable",1,REG_DWORD)
If @ERROR 'Error updating key [ProxyEnable] : ' + @ERROR + ' - ' + @SERROR ? EndIf
$Set = WriteValue($Key1,"ProxyOverride","127.0.0.1;<local>",REG_SZ)
If @ERROR 'Error updating key [ProxyOverride] : ' + @ERROR + ' - ' + @SERROR ? EndIf
$Set = WriteValue('HKCU\SOFTWARE\Policies\Microsoft\Windows\Internet Explorer\Control Panel','Proxy',1,REG_DWORD)
If @ERROR 'Error updating key [Proxy] : ' + @ERROR + ' - ' + @SERROR ? EndIf
EndIf
|
|
Top
|
|
|
|
|
#189531 - 2008-09-08 12:00 PM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: Mart]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
mart,
i did that earlier on but just don't know what is happening, it just doesn't work again. And this is the second time i have done with GPO that i am facing this problem. The GPO work alrite for you to see that it has disable the connecton tab, input a default homepage, disable changing homepage but it doesn't do the proxy changes. And that is what is ignoring me with the GPO thing. If i can get a script to do that, i will just want to forget about this GPO setting. the operationcomplete successfully without coming up with any error messages.
|
|
Top
|
|
|
|
|
#189540 - 2008-09-08 06:09 PM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: ekainyah]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
guys with the GPO now everything is working but with the exception of the proxy setting. Disable connection page works, disable changing default homepage works BUT the proxy settings is just not working. i am still wondering why.
|
|
Top
|
|
|
|
|
#189634 - 2008-09-12 11:01 AM
Re: Logon script to change proxy settings in a windows 2k3 domain
[Re: Witto]
|
ekainyah
Getting the hang of it
Registered: 2005-07-05
Posts: 51
Loc: Ghana
|
witto, i am not applying the restiction on computer bases but rather on users so that no matter which machine the user logon it will apply. i will double check on the setting to see where the problem might be coming from.
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 2220 anonymous users online.
|
|
|
