How to block access to Intranet Site from workstation logged in via RDP?

here issue here. have users make vpn connection , rdp office workstations. once remote in office workstations, can work if in office. want prevent them accessing intranet site if they rdp workstation remotely. if in office , logged in locally a console session, allowed access intranet site. there anyway can achieve this? intranet site hosted on windows 2008 server , clients win7.  domain environment.

is vpn solution through external firewall or internal service?

is scripting vpn login available?

script disallow domain access local servers host file sharing/intranet sites/your discretion.

set-aduser

http://technet.microsoft.com/en-us/library/ee617215.aspx

example:

set-aduser -identity %username% -logonworkstations "officeworkstation"

(to limit access workstation while vpned in.)

on vpn disconnect:

set-aduser -identity %username% -logonworkstations null

(to allow access computers while user in office, null should default 'all computers'.)

Windows Server  >  Security