User Lock Down

I assume that currently you ahve lots of "users" out there with Admin rights, and that they are used to having certain access, and to working in a particular fashion.

Obviously, your first step is to simply take away "administrator" privileges, and to provide "basic user" rights to everybody (other than to yourself and other "real" admins). No wait, I'm wrong! The FIRST thing is to get your boss to agree, in writing to a security policy, which at its core restricts who gets admin rights. Then make sure that your users know that this is coming. Find out from them what they do that they "need" admin rights. I most cases, you will find that a lazy administrator in the past simply gave your users admin rights to some file system or application or tool, just because it was easier than developing custom access policies. What a bad idea! By interviewing your users you can find out WHO needs to do WHAT, and WHY they need that. Then develop user security profiles and migrate your users to the appropriate profile.

And remember: just because a user says they NEED this or that type of access, they may telling only part of the truth. Find out WHY they need that, and WHAT they are trying to do so that you can provide them with a workablesolution.