We are planning to migrate from workgroup to Active Directory ( Windows Server 2008 R2: domain controller, DNS and Windows XP/7: workstation ). At this moment some computers are not allowed to access Internet ( we achieve this but letting blank the fields for DNS from network configuration window). Users does not have administrative privileges so they cannot change the settings. This works well no matter what Internet browser the users uses.

Can we do this in an Active Directory environment?