It involve using the Content Advisor functionality built into Windows Explorer. Since you can password protect this functionality even someone with administrator access will have the devils own time ...