Limit internet access from users on domain

[alexlights]

Hi. This may not be the correct place to post, but this is my favorite forum.
I want to limit/lockout internet access to users on my company network. Here is our setup.
Cable modem/router is supplied by Comcast. I do not have access to login to the router. From the Router we go in to 3com Switches which I do have access to. All users login to the Domain on our Win 2K server. We do have a logon script that maps drives. (maybe there is a line I can add in the .bat file for this). I am running the 3com supervisor software and I know the switch port everyone in using.

So what is the coolest way to start blocking internet access??
1) Go after the .bat file, maybe they could modify settings after logging in, but that would be a start.
2) Were not using proxy server stuff. Knowing that the modem is direct connected to the network, that my not work ether for the long term.
3) install a 2nd router after the Comcast and limit ports?

Thanks,
_ALEX

 

[Grenage]

A firewall or proxy server would be probably be the best idea, something to put between the router and switches.