You cant via the domain unless the internet is being distributed by the domain. Using policies only permits software access to the internet; however, if the persons have permissions to install or use .exe programs they can use a different browser to access the internet. I permit access with the router, so I chose and manage the permissions for Mac addresses to access the internet. So managers computers can access the internet and so on. For the no it all's that think spoofing mac addresses to get passed it, I will save some time and explain how I prevent this. Every computer on my network is registered, so policies that state no home computers at work. Using my command interface, all mac addresses are locked to an ip. If the mac changes or is not registered on the network there is no ip is assigned for internet or file share access.
TM
