Block access to the Internet from accounts with administrator rights

If a computer is infected with the user logged in as administrator (or with unusually extensive rights), this will cause more damage because the capacity for replication and harm will be increased.

Distinguishing between user accounts that allow system maintenance tasks to be run and accounts that can access the internet allows for a partial isolation of infections and centralised access to system resources.