"We have two finance machines that keep getting infected with different malware apps (porn popups etc...), purely because we've got to give these users more access than they _SHOULD_ have on a secured network. The users have been hit by a couple of dodgy advert iframe exploits which led to the initial infection, its taken us months to clean the majority of crap out of the machines. However, it still has some issues because of this."

why the heck are they exposed to the internet??????? or even to the rest of your network... airgap them and use a separate local network if they have to share a printer...

Our accounts machines are not on our network, they are on their own isolated one... for two reasons. 1) to prevent viruses etc. from getting in 2) to prevent them from being hacked by anyone else