Internet blocking Question/Allowing one site only

I am putting in a new HR/Payroll system for work that will allow employees to clock in from their pc through a web address. The web address is being hosted by the company providing the product so it is not on the intranet. This is not an issue for most of our employees, but we do block all internet traffic on the shop floor pc's. We do this by disabling the window where you enter the proxy addresses, grays out the option actually. But now I need these pc's to go to this one single address so they can clock in. There must be a way to do this I would think. Anyone else had a issue like this? I will note that I do not have access to any of our switches or routers, so I cannot do anything fancy there. I am researching GP to see if that can do it. Thanks for any help...

Wild off the cuff idea ... set the "Default Gateway" address to the IP address of the service you need to clock into, then put that address into DNS as a Host address record. I'd bet that would do it.

Another off-the-cuff idea: in the windows host file, set the IP address of the site that you need them to access, then set the DNS to something that will return garbage information. That way - unless they know the IP address of google, they should be stuck.

I agree - manually entering the DNS information should work, but as an easier alternative, why not set up a proxy server/app such as WinProxy and just block everything except the site(s) allowed?

A group policy can do pretty well what you want. Set IE6 (ie7 doesnt seem to allow it)to open in kiosk mode then if the user has no permissions to switch it from kiosk mode they will open IE and get the home page which you specify first.

If it is using a local address (example: http://servername/application/Login/Login.asp) then all you need to do is set the proxy servers to allow local (LAN) addresses and "block" all out-of-Network traffic and it'll work fine. We needed a similar setup here at the office and that's how I did it.

To further the security, I also configured the group policies in AD to disallow access to system settings so that users wouldn't be able to change their network info or network connection settings and what-not.

Of course, this is assuming your application uses .NET and IIS (I think that is a safe assumption).