To resolve the internal network issues, you must set administrative restrictions and permissions for each user specifically. You can specify groups of each organizational unit and perform different group policy tasks on different units. Shared data permissions and Administrative privileges should be categorized and assigned to only the authorized personnel.
Password Complexity must be enforced so that the chances of a password being compromised are rare. Password history policy and password expiry policy must be set so that users change their passwords frequently. Administrative Passwords must be accessible by authorized individuals only.
Access to internet must be restricted and SMTP Protection filter must be applied as well.
Sites containing malware and Spywares must be blocked and Domain users should not be assigned local administrator access to avoid any unwanted software deletion or installation.
Software and updates should be installed by group policy objects which will enforce automatic controlling. Certain features like registry editor should be disabled Network wide.
There must be a SUS (Software Update Server implemented in the network which will ensure the smooth installation of Automatic Security Updates across the network.
Each node must be synchronized with the server to ensure the availability of secured services and resources to each node.
To address External threats, firewall software must be installed on each network node to filter the malicious code attacks on each node and resolve its related issues in each network component.
An edge firewall in the network is a best possible security measure to detect and eliminate the possible security breaches in the network. A high performance router or a PC with software firewall can detect these breaches and resolve them.