Our current requirements for WinXP
IE > 6
Machine must be post sp2.
Must have autoupdate and autoinstall turned on
Windows Firewall (or compatible) enabled
(This choice was a compromise to make the initial rollout easier - we 
didn't have the time or staff to fully patch every machine before it got 
on the net, so we figured post sp2 and firewall on was good enough for 
initial connect, autoupdate will get the rest of the patches. )
Up to date AV (any probs, we give em symantec corp ed.)
MS Antispyware installed and enabled.
Firefox Version >= 1.07

Has worked really well.  Most of the viruses we get now are the AIM type - 
that install through social engineering.

Eric Weakland, CISSP
Director, Network Security
Office of Information Technology 
American University
[log in to unmask]
202.885.2241