What are the operating system settings (Windows) to increase its security?

Question

Windows

Hello. There was a task in writing an essay on the topic in question. I searched, but didn't really find anything. I assume that the problem is the lack of knowledge that allowed me to ask a more accurate question.
To write the abstract, an imaginary computer was taken that had not been used before and the disks were clean, which would remove many problems of the old system. The computer must be protected to a crazy state, but without using third-party programs, etc. The computer has access to the network.
Here's what I have now:

1. Disabling services that theoretically may not work as intended or are simply not needed. ( Remote Registry ). Windows service shutdown level.
   
2. Enable BitLocker. As an example of protecting physical media. Software protection level or feature. (I don't know what to call it)
   
3. Zero session exception. The level of protection using the registry. ()
   

What levels would you suggest. And what do you think are the important windows functions I missed. I think the list is big. Just drop it without explanation. I'll figure it out myself. It's just that the problem is not understanding where to dig and how windows works. I also understand that maybe this is too broad a question, but still.
Thanks to everyone in advance who will respond.

Answer 1

Offhand:
1. Setting up security policies, there are a lot of settings on this topic;
2. Create a user with limited rights (cut in "Users");
3. Zayuzat NTFS rights to files, quotas, and more;
4. Firewall and Defender.
What first came to mind.

Answer 2

It's just that the problem is not understanding where to dig and how windows works.

The problem is in setting the task.
First, answer the question - what is a secure computer in your opinion? This is a rather vague concept.
Protected from what? From what threats? How likely are these threats? What exactly needs to be protected?
For example, a specific task is to protect data from damage or loss.
Or protect your computer from interruptions.
Or from network attacks.
Or from a fire.
And everything is so simple - make a list of threats from which you need to protect, and only then think.
Protecting your computer just doesn't make sense.
Here you propose to turn on the bitlocker, why do you need it? What problems will it solve, from what threats will it protect? And most importantly, what problems will it create. And what does he even have to do with protection?
It's like being treated for who knows what. The diagnosis is unknown, but something hurts. You need to drink useful medicines.
Melaxen is an excellent medicine, it perfectly protects against insomnia - so you need to drink.
Forlax is also an excellent medicine, it helps a lot with constipation - let's drink it too.
Well, the result will not keep you waiting.

Answer 3

Above kiosk mode is just shutting down the computer.

Answer 4

The security of Windows services is only a small part of the attack vectors, but if you don’t spray it and consider only this, then you can google on the topic “windows hardening”, for example here:
https://www.acsc.gov.au/publications/protect/Harde ...

Answer 5

If you meant perimeter protection (in this case, everything outside of one computer is outside the perimeter), close all unused ports, both incoming and outgoing. Solve the issue with USB, or completely close access to storage devices, or certain rights: read only. BIOS for a password, prohibit starting from everything except the desired disk. For complete paranoia, seal the system. block.

Answer 6

Consider loading policies via gpedit or directly in the firewall. On some thematic forums, ready-made policy files are shared. But this is correspondingly not safe, a quick solution.