Over a period of a few months we've returned all PC's on the network to a clean XP Pro + SP1 and we won't allow any updates after SP1 to be installed. A hardware and software firewall, a decent AV package and the application of a little common sense does wonders in the way of security.

It sure makes a difference, we're back to normal speed in all applications, no unwanted access blocks to local and netfiles, no max overkill security protection that prevents you from using the PC the way you want to.

MS security protects you from "harm" by preventing you from going anywhere, if you can't get anywhere you can't get hurt and you won't have a reason to sue us which is their main worry.

btw. You can still download SP1 as a single file from MS, for that matter you can download SP2 as an .exe and all the little updates after SP2 as single files too.