Block access to the Internet from accounts with administrator rights

If a computer is infected with the user logged in as administrator (or with unusually extensive rights), this will likely result in more damage because of the account's increased capabilities and access to data.

Distinguishing between user accounts that allow system maintenance tasks to be run and accounts that can access the internet allows for a partial isolation of infections and centralised access to system resources.