How to make clever blocking of video content in a browser on a terminal server?

Question

System administration

So the problem is not just to block (this is no problem), but to block in such a way that the tech department cannot be blamed for this. Since this is a state office and few people work there, most of them watch video clips, or films, or series from the Internet.
Neither administratively, nor politically, nor obviously technically, this can be done.
As an option, either somehow try to do this through qos so that the speed is such that it cannot be used (that is, it would formally work), or somehow spoil the stream so that the video is not watchable. Users work in hp thin clients. Gateway to the Internet via tmg, it is planned to replace it with pfsense.
It was decided to replace it with pfsense for implementing the idea.

Answer 1

Options
to cut traffic http://wiki.squid-cache.org/Features/DelayPools
http://www.howtoforge.com/squid-delay-pools-bandwidth-management cut
by content type
mp4

acl streams rep_header Content-Type -i mp?$
acl streams rep_header Content-Type -i ^video/x-mp4$
acl streams rep_header Content-Type -i ^video/mp4$

That. the flash remains, the video seems to start, but it is cut at the video buffering stage. ha ha ;777 And the user sees the player with the message "An error occurred. Please try again later." The advantage of this option is that it does not completely cut off shockwave / java, etc.
either through l7 http://hubpages.com/hub/How-to-Configure-Deep-Packet-Inspection-Using-pfSense#
or on squid correct the config so that after 5-10 seconds the video stops
http://wiki.squid- cache.org/ConfigExamples/DynamicContent/YouTube

Answer 2

For starters, you can cut p2p

Answer 3

1) If you do not need Flash to work, block the player through the software restriction policy.
2) You can reduce the color of pictures to 256 colors, it also does not affect work in office applications.
3) You can try to analyze sessions and the volume of traffic received through each session, with a decrease in speed from volume.

Answer 4

Group policies:
0. To prescribe by order through the management a ban on the use of the IT infrastructure of the enterprise for personal purposes.
1. Disable the launch of unsigned applications for ordinary users from all places except c:\program files (+x86, c:\Windows).
2. remove everything superfluous from the terminal - chrome, opera and other firefoxes.
3. Disable all unnecessary plugins in IE.
4. Close the download of media content on the proxy.
5. Set up a proxy in IE, disable its change.
6. Prohibit changing the default browser.
Look like that's it.