Shadow passwords is a method for storing the actual user's password in a root-owned file that is not readable by normal users, unlike the regular password file. This protects the passwords from being read and cracked using dictionary attacks. Regularly audit user accounts for invalid or unused accounts, expired accounts, etc. Check for repeated login failures. Be sure to enable quotas on machines with many users, to prevent denial of service attacks involving filling disk partitions, or appending exploits to group-writable files.
Disable group accounts, and unused system accounts, such as sys or uucp.
These accounts should be locked, and given non-functional shells. Many local user accounts that are used in security compromises are ones that have not been used in months or years. Since no one is using them they provide the ideal attack vehicle.