I also work for a large university and have the same type of problems, but our solution seems to be unique compared to most of the other posts. Almost everyone has admin rights to their own computers, but the network admins run some kind of program that continuously checks computers for viruses, trojan horses, and unauthorized servers. If it finds any of these things it then blocks the computer from accessing the campus network by MAC address. The computer then has to be certified by a technician that it has been cleaned, patched, etc. before they will unblock it. Some departments have their own IT departments to take care of this, but many don't and end up sending the computers to the main campus IT department where I work. The kicker is that we charge the department $40/hr to fix their system so there is definitely some incentive to keep their systems clean. Otherwise their departmental budgets will all go to keeping their computers in working order.
Slashdot Mirror
I also work for a large university and have the same type of problems, but our solution seems to be unique compared to most of the other posts. Almost everyone has admin rights to their own computers, but the network admins run some kind of program that continuously checks computers for viruses, trojan horses, and unauthorized servers. If it finds any of these things it then blocks the computer from accessing the campus network by MAC address. The computer then has to be certified by a technician that it has been cleaned, patched, etc. before they will unblock it. Some departments have their own IT departments to take care of this, but many don't and end up sending the computers to the main campus IT department where I work. The kicker is that we charge the department $40/hr to fix their system so there is definitely some incentive to keep their systems clean. Otherwise their departmental budgets will all go to keeping their computers in working order.