How to set up security on computers in the office?

Question

System administration

There is a local network for 30 computers. Sometimes there are problems "I did nothing, but I got ads from somewhere in all browsers." Once I tried to cut the rights to users, there were problems "not enough rights to run the program."
Are there any recommendations, instructions anywhere on what and how to do in the simplest version, so that on the one hand, any byaka does not leak, and on the other there are no problems due to limited rights?

Answer 1

1. Antivirus on all computers
2. Restrict all users in rights (No admins)
3. Set up a proxy server with a virus check. Everyone on the Internet only through a proxy
4. On the mail server (I hope you have one?), Set up a scan of all letters for viruses and spam.
5. On the firewall, prohibit everything except ... "there is a list of what is possible" ...
Something like that.
At the expense of "not enough rights to run programs" - this does not happen. So you are doing something wrong. You just need to take it and

Answer 2

You take a decommissioned accounting computer, fry there, set up routing, install ClamAV and you're done :-)