With the Windows 7 WFAS I am trying to find a way to configure it so that programs such as Apple Safari, Firefox, Chrome, etc. can't be used for unrestricted Web browsing on a corporate network, but can be used for limited testing on corporate Web site(s). I haven't been able to find a good way to do this with the WF.msc. Blocking a program in the Domain profile Oubound restrictions (e.g. %ProgramFiles%\Safari\Safari.exe), blocks the whole program even if the an IP Address is specified in the Scope's Remote IP Address. And since the block overrides the allow, adding in an additional Allow rule has no effect. Since the Override Block options only function in encrypted connections/sessions that route isn't going to work very well with an externally facing Web site. That said, the Symantec EndPoint Protection (version 11.0.5000.x) Client won't provide this level of functionality either. To complicate things, the SEP hijacks the Outbound Program rules created in the WF.msc. When the SEP client is installed, the Outbound program Block rules created in the Windows 7 WF.msc no longer function at all! (Even ifthe SEP Network Threat Protection component is disabled) Possibly a Use Case for Windows 7 SP1 ? Or does anyone have a good solution to the Use Case in the first paragraph? Thanks

Hi, Thanks for posting in Technet. Windows Firewall does not have the function for your requirement. In corporate environments, we use ISA server and client to work. Internet Security and Acceleration Server Home page How To Prevent Users from Accessing Unauthorized Web Sites in ISA Server Arthur Xie TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”