NT 4 and surfing

I run a NT 4 network with 20 stations. I have some “difficult” guys surfing unauthorized sites – some with cracks and some with porn. I am interested in those looking for cracks – I just want to see what they are looking for in order to proactively prepare the net against potential attacks.

What is/are the best approaches? eg. setup a directory on the server where to copy, while surfing temporary internet files?