Windows 7: securing windows 7 32/64 bit in a domain environment

Hey I need your guys' sugguestions on what to do to secure windows 7 in a domain environment

what we've done so far is set most people to a standard user, set UAC to the second notch from the top, have DEP enabled for third party programs, have the default policy set in windows firewall advanced (is this controlled by sysadmin?), disabled fast user switching, and have a daily scan antivirus with central console and biweekly reports emailed (symantec endpoint).



Of course we try to keep all software up to date with separate updaters (like flash and acrobat) and windows updates through WSUS. IE8 is also in protected mode. Is there anything else we can do?

I would hope that you have someone MCSE certified handling the set up of this domain. That person should be able to handle it without a problem. If it is security you are worried about, find someone with a CISSP certification.

Really I'm just looking for what can be done on workstations and laptops and implemented in an operating system image, as I only work as help desk support. Anything that needs to be done by group policy I can ask our system administrator.

Maybe implement SRP or AppLocker?

http://technet.microsoft.com/en-us/l...92(WS.10).aspx