How to prevent a new device from accessing the Internet/Intranet?

Question

Domain Name System

Good afternoon!
There is CD WS 2008R2, DHCP, DNS, AD on it.
It is necessary to implement the following task:

1. When a new device is connected to the network (Ethernet, Wi-FI), it receives IP via DHCP.
While the device is not connected to the domain (it has not passed the check for meanness), it is necessary to prohibit its access to the Internet, that is, register the left gateway (for example)
How to do this using standard Windows tools.
2. You may need a proxy server, not on the CD, but on another machine, the IP of which DHCP will give to the device, but if the user is not authorized in AD, then he will not be able to see the Internet (as an option, of course)

Answer 1

Enable authorization on the gateway/proxy via Kerberos/NTLM. Regular feature .