Internet access for different Groups

I would like to know if there is any way to disable internet to say... all groups except for the administrators.

If there is a way; how would I go about doing that?

 

Using ISA or Proxy server you can do this on a Group by Group basis.

 

i'm assuming that your solution (which seems quite elegant) works only for windows 2000 server that's feeding internet to clients. i suppose i should have been more specific: the system is set up with a file server (win2k adv server) and about 15 client PC's. however, it is not set up as a domain, but merely a workgroup. all of these feed into 10/100 switches; also connected are a router for the internet along with an hp print server. i would like to keep internet off the server (there is actually an "issue" as there's someone else in charge of internet access. this is a sub-network at a school, but entirely separate from the internet. either way, she is running NT4 servers, and our 2000 server would create conflicts etc etc) the 15 client pc's are configured for DHCP off of the router. everything is on the same subnet mask so that they can see each other happily. in short, i need to find a way to restrict internet access locally. so far, the best (and simplest) i've found is to deny nonadmins permission to iexplore.exe. however, this does not solve the pesky problem of shell integration. therefore i've also tried unregistering (a la regsvr32.exe) shdocvw.dll - Shell Doc Objects Control and Library - but to no avail. if there were a way to disable the shell integration portion, i think i might be set.

thanks