How to block access to the network?

Question

Active Directory

There was a need to isolate a domain user within his machine, while leaving domain authorization, the current profile. Cover access to the domain network. The matter is that even under standard domain users there are too many rights. And the user has a lot of point accesses that are too lazy to wool.

Answer 1

Have you tried it like this?

Answer 2

The rules of the standard WIndows Firewall, delivered to the workstation through the GPO policy, block access to the entire infrastructure, except for the minimum necessary for authorization in AD (that is, via AD ports to the nearest domain controller and to DNS).