This may not be the answer you were looking for, but we use a content
filter that includes a global proxy, so then it doesn't matter where
they take the device or what they connect to - its always filtered.
Especially good for institutionally owned d...
