dan_linder's comments above are a terse summary of the only reason I find that AUPs have any value: to clearly state the expectations that IT has of its legitimate users, and to clearly summarise what will happen if those expectations aren't met.
This argues strongly against the HR-style super-waffly AUP that reads like someone got a bulk order of WeaselWords and decided to use them all at once. Those policies are strictly in the cover-your-bum, liability-shifting class of AUPs, and I've never once, not in 21 years of network and systems admin, found those to be of any use at all. This also argues against any concept that you can use an AUP against outsiders; they have to obey the law, sure, but they have to do that whether you write it down or not; other than that, what you write down has no weight on them whatsoever.
So: a simple, short document that says what you shouldn't do with the work computers, and what happens when you transgress, is the only time I've found an AUP to be of value. In those cases, when I've detected transgression, I've been able to go quietly to someone in a non-confrontational manner, point at a two-page document they signed that said they wouldn't do X, point out (with specifics) that I know they're doing a lot of X, and ask them to stop it so I don't have to invoke the Forces Of Darkness and get them sanctioned just like it says down at the bottom of page 2, just above their signature.
So, how do you write one of these? Well, SAGE has a good publication, called A Guide To Developing Computing Policy Documents (Short Topics in System Administration, Dijker, 1996) if you know anyone who has access to the SAGE library.
Failing that, develop your own short list of the things that happen at your place of work that cause problems for the network and its users as a whole. The single thing I find to be of most value is an explicit prohibition against sharing a password, ever, for any reason. Many employees think that the best way to give Sam access to their mailbox while they're on holiday is to give Sam their login details, not knowing that - although it's good for the business that Sam can read their mail while they're away - that can be done just as easily and much more securely with the technology we have to hand. It's also a really easy policy to state in a single sentence.
Most of the major issues can be proscribed in a single sentence. Write down as many such sentences as seem good to you. Agree the content, and the sanctions page, with management. Get everyone to sign it, and give them a copy. Job done.
