Screw 'em. I fought the same fight for 18 years. Finally I would simply back up the necessary data myself and lecture them without mercy each time (about every 5 weeks on average) they opened a script-containing email or virus loading website. Then I would take my own sweet time cleaning the machine(s) and restoring the required data... Not that I'd dog it, of course, I just wouldn't kill myself to make sure the a-hole boss could check weather.com to see if he'd need an umbrella on the golf course... so he and/or his dribbling idiot sons (He only bought the place so that they wouldn't have jobs requiring paper hats and extensive use of the phrase "Would you like fries with that?") would have plenty of time to complain about people not following the rules (it was ALWAYS someone else's fault, ya know).
Hard to believe I've been looking for a job for 3 years now, huh? [chuckle]