Get BlueCoat proxy/content management hardware on your network. I know, folks probably think I am pushing it a bit hard these
days...

Seriously, if you need to keep close tabs on what your users are doing on the `interweb', then this is the easiest virtually 'turn-key' thing you are going to come across. Of course, if you are hard core, configure squid and apache proxy servers.

By the way, this is my least favorite security topic... Anyone who has monitored proxy logs before can tell you that you can make anyone look bad with them.