Another thing you can do is set registry permissions on HKLM\SYSTEM\CurrentControlSet\Services to not allow anyone (even administrators) to create new keys. Obviously, this will also make it difficult for an administrator to install new legitimate services, so that is something you must balance. Ano...
[ more ]