Since this is a Windows domain, it's likely the accounts they are using have complete network access to all the workstations, so if something bad happens, it can be across the network in seconds. First step is to make sure all users are doing day-to-day work, browsing the web, writing documents, etc. in accordance with the principle of Least User Access.
My practice is then to create a domain account and give that account admin privileges on all workstations (PC-admin), and a separate domain account for server admin work (server-admin). If you're concerned about your servers being able to talk to each other, you can have individual accounts for each machine (<x>-admin, <y>-admin). Definitely try to use another account for running the domain admin jobs.
That way, if you're doing something on a compromised workstation with the PC-admin account, and it grabs the chance of your having admin privileges to try to get at other machines over the network, it's not going to be able to do anything nasty to your servers. Having this account also means it can't do anything to your personal data.
I must say, though, that in one place I know where the staff worked with LUA principles, they didn't have a proper virus infestation during the three years I saw; another department in the same place that had everyone with local admin and IT staff with server admin had several outbreaks, one of which took a week of IT time to clean up due to the spread of infection via the network.
It does take some time to set up, but the potential savings are huge if you are hit with problems.