If you take one additional step its actaully much more secure to make the DNS changes on the router. In addition to changing the DNS addresses your router hands out you need to add a rule in the firewall (most routers have basic firewalls built-in) that blocks all requests to DNS servers that are not the DNS servers you assigned. In this configuration even if the DNS servers are changed on a particular PC no lookups can be preformed. 

This is all a moot point on the Att 2Wire router as it appears it will not allow you to change the DNS settings.