We have 5 different people, all of which do things 5 different ways. On one end of the scale you have folks who address issues as they are brought to light, on the other end of the scale you have folks who work to resolve issues before them come to light.
What's worked for me is looking over my trouble tickets to see if there is a pattern. Users having issues with an application? Ok, let's look at that further. Is it due to a troublesome application or lack of user training/understanding? If it's a troublesome app I look at getting the problem resolved. If it's something that I can duplicate I go to the vendor with it and ask them to resolve it w/o my having to purchase an upgrade if possible. Training has always been an issue, our hiring process says that users need to have an understanding of Windows XP and Office 2003 along with basic internet/email skills. It's right there, plain and simple. Often this part is ignored - they'll ask the user if they can use Windows/Office/etc and they always say yes. I end up kicking that back to HR asking them to define use - hell, my kid was moving the mouse around and randomly typing on the keyboard when she was 2. For many of our apps I've written basic training documentation, that seems to help.
I also try to be proactive in regards to security. I check our AV logs daily and whenever a new patch is released for a product we use I throw it on the test box to see how it plays with what we were running. If it passes I'll apply it - not too hard to do. Write a patchlink script or just deploy it ASAP. Some of my workers wait until out monthly security report is due then they scramble to get caught up. I've also worked to close a lot of security holes. Email is one - let's see....no reason for users to email .bat, .exe, etc...so I block them. Mailing lists are locked down to members only, everything else has to be approved. Earlier this year a greeting card link that contained Trojan.Vundo hit the mail system. I saw the first one come through from an outside source, which it blocked. I then wrote a filter to reject the content of it. None of my 300+ users received it. The others? Many people ended up clicking on the link and ended up with downtime, a couple of places were so infected that we dropped their network connection until they cleaned up.
The folks above me have different metrics. My boss has a motto - "due diligence". When Vundo started taking over machines we had a conference call and had to report in. When I had to share my experience I said "what trojan? I blocked that thing at 5am, it's been quiet out here". Bad move....I was scolded for not doing my due diligence. He'd rather have us step in and work all night to clean up a mess than to prevent the mess in the first place. Yeah, show me how that works. While you guys were working 18 hour days cleaning up the mess I worked an 8 hour day then went out to a nice quiet dinner.