Quote - He proudly showed how one user was logged on to the BBC web site for 8 hours, which caused much muttering along the lines of 'something must be done to get him to do some real work rather than surfing the net'.

ROTFL... dude was/is a flaming idiot.

The only way you can tell what and where someone goes ("how long" would be at best a rough guesstimate) is to force the company through proxy servers, then grep the access logs for a user's IP addy. Then you start reading what you scraped out of the logs.

I remember having a live tail of the proxy log at the classroom when I taught - it was priceless to see the look on some kid's face during lab time when I reminded him/her (w/o leaving the desk) that surfing a non-curriculum site was a waste of his time. Some would try to bluff their way out of it... until I recited the URL out-loud. ;)

A sysadmin does have some control over knowing what, where, and how... but it takes a bit of scripting, some services in-place, and just a little bit of an eye for knowing what to look for. :)

/P