Most AV will destroy Windows over time more so than any virus ever could. Got cryptolocker? Do your clients? Your not securing the profile and the AV will not stop it. When I proactively protect the network it's seen as a waste of time? Why is this common sense approach not common sense to so many? Let's talk.
One of my favorite but by far the most unappealing approach I use is run XP SP3 in SafeMode w/ Networking inside a VM using Chrome. Still take a snap just in the event China or Russia defeat it, we can roll back. For W7 / W8.1 - re-install every 30 days (sometime rearm if lazy), never activate newer OSs, all inside restricted snapped VMs running with non-administrator user accounts.