the way I am reading your posts it's almost saying that when you change the settings he knows about it and changes them right back under account. That means he somehow has admin access to change them. If he doesn't have admin access then he should not be able to change the settings you put in.

Use a sonicwall - its a firewall with content filtering services and black/ white lists. target the websites, and the whole network cant access them.

I found a better way to do this, redirect them to a non-existant proxy server and disable the Options/about:config panel.

The only problem now is that he uses Opera!

How about installing a firewall with password protection?

ZoneAlarm, I believe because I'm using the corporate version called Integrity Client by TrueVector are the same, has password lock so that you can disable the entire net traffic until the password is entered.

ZoneAlarm will be installed in all profiles in your computer. And only the right password for ZoneAlarm will allow you to enable the locked internet connection. It's a thought...

Actually I just installed ZoneAlarm free version after Windows Live OneCare BETA expired.
No this is not an option because Internet traffic must go through at all times, I just need to block a (some) browser(s).