youd have to moniter you access logs for allot of activity to certain ips addys that arn't resolved, track them down to see if they are tunnel servers and deny access to these ips. but thats a lot of work, why not just let them get fired for not doing their job. of course these always sms server which can tell you whats running on everyones machine if you got a few grand to spend on it.