Vulnerability question

[PryGuy]

Good day!
I offer a solution to our clients that has a server with all connections facing Internet closed, so the server is secure (correct me if I'm wrong). Everything is allowed for the LAN clients. Is it possible for attacker to obtain control over a client (a Windows machine for instance) that is behind the firewall (my server) and then perform attack on the server from the inside?
Thanks in advance!

[HermanAB]

Anything is possible when you have Windows in the loop.

Under normal circumstances, with the Windows machines merely turned on but doing nothing, they would be quite safe. However, things start to unravel when the users make connections to external servers using their web browsers, music players, chat clients, VOIP clients, yadda, yadda, all of which can have security exploits.

[PryGuy]

However, things start to unravel when the users make connections to external servers using their web browsers, music players, chat clients, VOIP clients, yadda, yadda, all of which can have security exploits.

So this is possible in theory? If yes - how do I make server secure, if it's possible at all. It's a pain closing ports inside of the LAN actually...