Show of hands: who here would want to be the admin for a network you know is going to be routinely infected with any number of malware or rootkits.
[1] https://en.wikipedia.org/wiki/Secure_Web_SmartFilter_EDU
Things are much easier if you "embrace" the idea that you'll be infected, and that machines aren't special snowflakes.