I went thru this at a previous company and definitely found it to be a pain. It's not a matter of whether to work there or not, it's that the 'client' wants it and employees invariably spend too much time on the internet. Some abuse it because it is a faster connection than home. Anyway, in software firewalls, such as WinProxy by Ositis, you can choose to allow or disallow sites, and use blacklists & whitelists for a more comprehensive selection process. Also, remember you can 'surf' from anywhere in Windows that has an address bar, including desktop folders, Explorer, and Outlook. Since it also records all interaction thru the firewall, you can create a policy for the client warning the users that their actions are being watched. Sometimes users are just like children and have to be sent to timeout!