Stopping access to certain websites.

Dalek, sorry for not answering your question directly. There are several approaches to limiting access to some sites; they are well explained in literature. All you need is Google.

I want to explain, that the problem your friend has is probably not related to access of the employees to the Web. If excessive use of some Web sites seemingly present a problem to productivity, it simply means that the employees are not motivated to do productive work; there is are no ways of managing people's work based on the result of the work, not by working ours spent in the office.

I worked in many companies and noticed that the Web restrictions are never applied in successful healthy companies; the moment of adding such restriction is often a clear sign of the company going to decline or ultimately out of business.

I have the opposite — positive — experience. One company started to enforce dress code, introduced draconian Web restrictions even on sites that I needed for my work (for example, some sites related to Open Source were classified as "advocate groups"; however I could pretty easily work around such "protection"); in another department I even saw idiotic "team build" exercises. It happened when I was about to leave the company; many cubes became empty, I did really not see people working. When I visited the company few years later there was no signs of such things; all restrictions were removed; company is working.

I simply cannot imaging how such measures could improve things.

—SA

why not just go with the solution you propose and restrict access to the host file, then the users can't change it.