Hi Jeff,
Password any administrator accounts so they cannot change themselves. A
limited user does not have the power to change themselves to admin, they
must have access to an admin account to do that. Ensure that the default
admin account is passworded as well - and don't use simple, easy to guess
passwords.
As to web sites, you will find it's difficult to block everything, however I
find that the most effective way is a combination of web address and keyword
blocking using a router (which also must be passworded to block them from
undoing the filtering). The parental controls you can place on the system
itself are easily overridden.
As a parent myself, I often find that the most effective way to control my
children's surfing habits are to restrict the hours that they get to go
online, and to immediately remove that privilege (yes, it's a privilege, not
a right) if they violate the rules.
--
Best of Luck,
Rick Rogers, aka "Nutcase" - Microsoft MVP
Associate Expert - WindowsXP Expert Zone
Windows help -
www.rickrogers.org