Restrict and manage domain-joined computers/laptops even when they are connected to personal home Wi-Fi networks

Question

Hi Support,

In our office environment, we currently allow access only to specific websites through the Fortinet firewall for all client systems connected to our Windows Server 2022 Active Directory.

We now want to implement a similar restriction for users working from home on their laptops, which are also joined to our domain. The objective is to ensure that only permitted websites are accessible even when users connect through their personal Wi-Fi or broadband networks.

Kindly advise if there is any Group Policy or configuration that can be applied through Active Directory to enforce this restriction for Work from Home users, or suggest an appropriate solution.

Thanks & Regards,

Ravinder

Answer 1

Dear Ravinder Makkar,

Group Policy alone cannot enforce website restrictions for users working from home, because once they leave the corporate network the Fortinet firewall rules no longer apply. Windows Server 2022 Active Directory can push policies, but those policies only govern the local machine and cannot filter outbound traffic directly. To achieve the same control remotely, you need to extend your perimeter enforcement through either a secure web gateway or by tunneling all traffic back into the corporate network. The most common approach is to require VPN connectivity, so that all internet traffic from the laptop routes through the Fortinet firewall, where your existing allow‑list rules continue to apply.

If you want enforcement without VPN, you would need to deploy endpoint agents that integrate with Intune or Defender for Endpoint, which can apply web filtering policies locally. Microsoft Defender for Endpoint supports web content filtering that can be configured via Intune and enforced even off‑network. This way, you can define categories or specific URLs that are permitted, and the agent enforces them regardless of the user’s Wi‑Fi. In practice, the best solution is a hybrid: enforce VPN for sensitive work and configure Defender web filtering for broader compliance, ensuring that your seasonal or remote staff remain under the same restrictions as office users.

If my answer is useful for you, please hit Accept the answer to support me.

Thank you,

QQ.