Any Unix program (command) to connect to a domain uses a method 'gethostbyname' from RESOLVER. First thing what this method does is reading /etc/nsswitch.conf Where it finds a line: 'hosts: files dns' which means: to look for hosts in files (/etc/hosts), then query dns. So, if you delete 'dns' from this line and leave only 'files', user can only access hosts listed in '/etc/hosts'. And this is exactly the way to create 'white list' of domains. Cool!
Windows has /WINDOWS/system32/drivers/etc/hosts, and it uses it. It uses dns too. But where's the config that defines what to use and in what order? Is there kind of /etc/nsswitch.conf file or a record in registry?
P.S: I promise to inform our system administrators of Windows, so that they could create 'white list' of domains for users in this elegant unix-way instead of using ugly IE 'parental control'.