"Clean sweep of spyware"...

Surplus all IT assets (hw/sw) and acquire new. Dump *anything* Microsoft and deploy only Linux for servers and endpoints. Harden everything: firewalls, routers &amp; switches, VoIP &amp; CCTV infrastructure, HVAC &amp; bldg system ctrl, clients/servers. Pentest.