Our users do not have admin rights to their PCs or laptops, so they can't install or change anything (I work for a mortgage company...these are mostly processors and loan officers and they are dangerous believe me). The desktop lockdown has saved our help desk tons of time...they'd get a call that someone's PC was slow and wander over to find they had loaded a 200 picture slide show as their background, added the dancing jingle cats and were playing music while working...or the idiots who would say something was wrong with some application they had to use and we'd find out they'd reset their screen resolution down so that only half the stuff could display. Life is simpler now!
We have a porno/violence/gambling filter on web access...beyond that they can go anywhere they want but they can't stream live video and/or audio from the branch offices but we can in the home office. That is due to a bandwith issue - we were getting constant compaints that our primary origination software was sloooowwww - a little investigation found that everyone and their brother was streaming their local radio station.
For filtered sites, if it is filtered in error we can (and do) white list it. This has included sports sites which were wrongly filtered as gambling. We do log all web access but in the 4 years we've been doing that no one has ever looked at the logs.
Those of us in IT have the keys to the kingdom, I can do anything I want on my laptop and PC and go anywhere.
Most of our equipment is pretty new, not to say there aren't a few ancient desktops floating around in the remote sites.