How to centrally control Internet access for an average organization?

Question

System administration

Colleagues, please advise a tool for organizing Internet access filtering for an employee. Shared Active Directory domain, infrastructure based on MS solutions, about 400 users distributed across 3 sites. Each site has its own Internet access. Bought KAV in standard edition. Mikrotik is used as gateways with network aggregation.
Now on one site access is filtered by Squid with transparent authorization via Kerberos and NTLM, on another site access is filtered through the Web Filtering KAV component, on the third point access is not controlled by anything.
The main criteria, in order of importance:

1. Ease of deployment
   
2. Transparent authorization in AD
   
3. To not cost like a helicopter
   
4. Automatically updated block lists
   

I am looking for a solution to restrict Internet access, share your experience, who uses what.

Answer 1

pfsense ( manual for setting up authorization in AD)

Answer 2

Kerio control ( https://www.gfi.com/products-and-solutions/network...

Answer 3

In the office in which I worked in the 14th year - very robust, very rich and having a network of branches "from Moscow to the outskirts" access to the tyrnet was built quite simply - everyone went through a single Moscow proxy (squid essno), where block lists and authorization in the domain and access by groups were configured. There was no bumping, because in those days it was not particularly relevant.
It will be really amazing for you how - because now everyone has been issued certificates to anyone, and it's easy to cheat the employer in this way - for example, you go to mail.ru and inside the connection (which is opaque for squid) switched to video.mail.ru, love.mail. ru etc.
You don't have a lot of options - except for Kerio, about which I won't say anything, except that I know what squid is - there's nothing special ...

Answer 4

If you stop at Kerio - test and chat with technical support before buying)