I would look at setting up a proxy. It's a bad idea to let each and every workstation have full Internet access on their own. By forcing the workstations through a proxy you have way more control and...