This is a powerful "lockdown" system, designed to protect your system further than anti-virus can.

Base Config:

• Rename local admin account
• Disable Guest account
• Disable Microsoft accounts
• Enforce Password protected ScreenSaver (after minutes?)
• Disable UPnP
• Disable Autorun
• Disable Terminal Services (in)
• Disable exe from %appdata% (except for whitelist)
• Disable Windows 10 Keylogger
• Enhance logging - Log all logon and logoff events
• Monitor log clearing
• Alert on excessive logon failures
• Disable Office Macros from Internet
• Disable OLE in Office
• Disable "App Stores"
• Disable unused or deprecated network protocols
• Enable Windows Firewall
• Uninstall Blacklisted Applications

Optional Config:

• Restrict Local Administration Tools
• Enforce User Access Control settings
• Enforce Logon Message
• Disable USB storage ( Write or Read/Write )
• Disable optical media ( Write or Read/Write )
• Disable installers
• Disable common cloud storage
• Prevent Social Media access
• Prevent Public Webmail access
• Scheduled secure free-space delete
  
• Ransomware Honeypot
• Alert on Unencrypted Disk (can be applied to laptops only)