of course the solution where I work is a simple multi stage process.
1. Never let NT servers near anything critical, a bit like don't let a 2 year old play with a power socket and a paper clip.
2. Never, ever, EVER allow anyone to install, or god forbid, use IIS.
3. If you have your system running just right, immediately disable Windows Update.
4.When the CEO comes in saying how cute Outlook is, slowly reach for the baseball bat under your desk and get him on the way out. Dispose of the body later.

These simple steps will keep your network running much better