Running a network of almost 12k pc's and one thing i can tell you: your employees WILL find a way around any measure you take. Take for example Yahoo! messenger: block its ports and still you can run it on http, straight off a web page, so you will have to filter that address out through a proxy, router, etc... You`re on a quite big task, trust me. But good luck!!!