server 2003 small business setup

Hello everyone, sorry if this is in the wrong section, but I could not find an other section, or a server section.
I was just recently hired by a medical clinic to help fix their computer problems. (OMG) When I arrived there:
I found key loggers on their systems.
They had no antivirus or antispyware.
They did no backups, or have any idea what a backup was.
There was stealing and deleting of data it was a mess.
They had a server 2000-box setup in the corner installed and configured so wrongly I think it was a prank. Therefore, I am redesigning their network and systems.

They are now all running antivirus (AVG) and have been cleaned of spyware and keyloggers, and are running very nice.
Now I need to setup a server 2003 small business computer to handle all their medical records (over 40 gigs of txt) and all their new scanned documents (over 500 gigs)
What is the best way to setup a domain controller for them without formatting the XP Pro boxes they all run. The reason for this is most of the programs they use the discs no longer work and the companies are out of business.
I require that the domain controller (server 2003) will log all files created and deleted and by whom. It will back up onto two terabyte hard drives and one off site backup (I can handle that) I need it to be simple so that I don’t have to be called over everyday when there is a problem.