The best practice I can recommend is try to anticipate things they are going to do anyway and counter them before they happen.
They will want to do file-sharing. Install Kazaa Lite. It's not being actively updated, but you can still find it out there.
They will visit websites with spyware/virus/adware/malware installers. Install FireFox, MS AntiSpyware (for the real-time protection) and a good AV client.
Make sure things are as automated as possible. Windows updates should download and install automatically, you should run regular (at least once a week) AV and spyware scans. This should all take place preferably at a time when the luser won't be using the computer (5AM is pretty good).
Lastly, educate them a little bit. Put it in words they can understand. Don't use terms like buffer overflow, security hole, or anything. Just tell them they do bad stuff and slows their computer down. That's all they need to know. Teach them to use the X in the upper right corner of the screen to close a window, not the buttons in the window (for those ads that try to mimic dialog boxes).
It's not a fool-proof solution, but it will reduce the problems into smaller, less frequent ones that you can deal with much more easily.
P.S. I once worked on a system that had 1000+ spyware items detected, but I don't remember the exact amount. It was Windows 98 and the system resources were hovering around 47% after a fresh reboot. Thank God Ad-Aware could run in safe mode!