Switchable between :Work Network settings/Home Network settings using AD

ondafly

First off - I'll try and explain the current situation and what I'm trying to do.

Currently:
Users have work laptops, which they bring home and connect into their home broadband routers . They can surf away happily at home. They then bring the laptops into work and attach them to the work LAN :rolleyes:

We do have corporate enterprise AV software, but what I want to try and do is the following :

What I'd like to do :
User brings laptop home, and can only surf to 1 website (our corporate VPN). When the laptop is connected back in the office, the proxy settings in IE change, and they can surf any website through our corporate proxy.

I would like this all controlled via Active Directory (if possible). Ideally a prompt when the user signs in, asking are they at home or work, and the settings apply from there.

Any help mucho appreciated

JDxtra

Sorry, I don't know the answer. Never heard of lock down like that before so not sure if you can do this with AD policies.

But I did experience a brief shudder down my neck at the thought of laptops being on an exposed broadband connection at home and then being brought back into the office.

LoGiE

Well if you used a VPN client from cisco or AT&T for example it can be configured to disable the local adapter and use the virtual one, thereby routing all internet traffic through the VPN to your work internet connection - proxy - firewall. You just need to make sure you've sufficent bandwidth or your home users will start to complain;)

Cryos

Hi Mate,

Its a difficult one to police; The only way you could possibly do this is by using WMI Filters. I have never used them in practice which is why you need a bit of play time on a laptop if you have one in work for testing. You could setup a New OU. (Prefrably under your main OU) Call it testing, Create 2 policys. e.g GPO_LAN GPO_Offsite

Make GPO_LAN the first on your list of policys for that OU, then followed by your offsite; Setup your proxy settings as you prefere on your lan one.

What you need to figure out (sorry i cant be of more help on this, i havent implemented this in a Production Enviroment) is using a WMI Filter to apply the policy For example if the ip is something like 192.168.*.* then GPO_Offsite is in effect, likewise for your lan range.

You have to be carefull, even if you set these policys if the users still have access to the Internet Explorer control panel they could override the settings....

Capt'n Midnight

AD won't work when the user is off line.

In AD setup them up so that they can only use the work proxy server so they have to logon to the vpn to surf.

How to stop them using firefox or opera etc. is a different problem.

Static routes is another option - but how to allow them to connect to an Irish ISP and the VPN and miss most of the internet ain't easy, not really practicable .

does your VPN solution block access to untrusted networks ?