Our environment consists of about 80 users running Windows 7. Previous to me showing up as a full time IT employee, the company had contracted an outsource IT solution. As part of their set up, they gave every user full administrative access to their local machine, disabled UAC (their reason: "because those pop up windows are annoying"), and disabled the Windows firewall on all the machines (their reason: "because we have a gateway firewall"). As you can guess, they were eventually fired.
All of our users' computers have Trend Micro OfficeScan for Virus and Malware protection, which is doing a terrible job even though they're all up do date with their definitions. Users are constantly getting infected with malware, which eventually leads to us spending time reimaging their machines.
My boss's solution to the problem is this: http://www.barracudanetworks.com/ns/products/web-filter-features.php. The system he wants, with licensing, will cost about $7000. However, we already have a SonicWall NSA device that boasts a lot of the same features that still isn't getting the job done.
So here's my question: Is tightening up the security on the machines going to be good enough to back me up when I talk my boss out of spending the money? My thoughts are we move everyone to non administrative accounts (they don't need admin privileges to carry out their jobs, so it should be a non issue), we turn on Windows firewall on each computer (If we were to get a self replicating virus or malware outbreak right now, we'd be screwed), and we turn on UAC (will this matter if they're non admin accounts?). I've recently implemented a WSUS server and we're keeping everyone up to date with security patches through it (I can't even count the number of computers that had updates turned off...). My plan is if people don't have admin privileges and their computers are up-to-date, we can greatly cut down the amount of malware.
I've still got lots to learn when it comes to protecting an entire network. So please, if I'm overlooking something or if I'm not on the right track or if I could change a few things, I would love your input. I just want to get them out of the awful habit of throwing money at problems and hoping it fixes it.
Update: I've marked an answer as complete, but I think it'd be of great benefit if people continued to share their insights and ideas. I now have a solid plan of action that'll keep me busy for a little bit.