New Network Administrator Needs basics

I think there is another point consider in this case. What services your server runs would pretty much mean you might have opened up more "holes" for people to probe your server. Take the effort to check through services and disable those that are not required.

Say, if your server is a file server, not web access, then you should disable the IIS services. It is a tough start but you will need to determine what runs and what doesn't

Thing is that in order to control all access to your server you'll first need to identify what services you would like to give access to and to whom. Then decide on how you want to give them access. A good start for this is a risk assessment: what risks are introduced by opening up a service and what to do to control that risk.
As said earlier, locking down your OS is the first step. Then lock down your applications as well. As you have identified UA users, you'll probably know how they got access. If not, try to improve logging by adding more details.
Often UA users still get access through unexpected trust relations between systems. Removal of these trust relations is part of the lockdown process.