But you don’t. Because you don’t.
Nobody does. Windows is closed source and its inner working is a trade secret. This means you cannot know how to lock down windows. Of course there are best practices based on info from microsoft or people who know a thing or two about info sec but it’s all guess work and/or trusting the developer by its blue eyes.
Thats something Ive never understood about closed source.
The OS, in its entirety, is on your computer. Why are you not able to open it up and root around within it? Is it just encrypted to a degree it cant be cracked? Or is the legal ramifications of unraveling it just not worth unraveling it?