Application filter looks good, and I have a specific use case for a few problem users - we want to disable streaming video for them. However, almost all our other users need access to youtube and facebook for portions of their jobs.

Is there really no system for this? Application filter seems to be all or nothing, with a limited whitelist. I would have to whitelist every IP except the few people I want to filter, completely separately from my Content Filter groups (which are AD based).

Am I missing something? Trying to use Content Filter to stop video traffic is an exercise in frustration, almost all comes through https, and even the stuff that doesn't still seems to be 50/50 on MIME type filtering.