This awesome tool is highly recommend

Requirements

• [x] Standards for a highly secure Windows 10 device
• [x] System up2date with latest Windows 10 stable version
• [x] (default activated) internal Windows Defender protection instead of external "Security" solutions
• [x] Latest Driver and Program updates
• [x] No "Tuning" tools (not even stuff like Ccleaner!)
• [x] Only necessary programs / apps / games which you realy need
• [x] Hardware Requirements for System Guard / Hardware-based Isolation
• [x] Hardware Requirements for Memory integrity
• [x] Hardware Requirements for Windows Defender Application Guard (WDAG)
• [x] Hardware Requirements for Windows Defender Credential Guard

Hardening

• [x] set User Account Control (UAC) to maximum
• [x] use Software Restriction Policies (SRP) with a default-deny mode
• [x] use Defender Firewall with Advanced Security
• [x] Always display file type extension
• [x] Manage Windows Defender Credential Guard
• [x] Install Windows Defender Application Guard (WDAG)
• [x] Enable Memory integrity (HVCI)
• [x] Enable Network Protection (NP)
• [x] Enable SmartScreen and enable SmartScreen Log
• [x] Enable Controlled Folder Access (CFA)
• [x] Enable Attack Surface Reduction rules (ASR)
• [x] Harden Address Space Layout Randomization (ASLR)
• [x] Enable System Guard Secure Launch
• [x] Enable cloud-delivered protection
• [x] Activate Potentially unwanted applications (PUA) protection
• [x] Enable Bitlocker Encryption with Startup PIN & read about Countermeasures and reduce DMA threats
• [x] Use Windows Sandbox for unknown/ untrusted binarys - you can use it with right click menu!
• [x] Enable sandboxing for Windows Defender Antivirus
• [x] Only elevate executables which are signed and validated

Further Hardening

• [ ] Specify the cloud-delivered protection level
• [ ] Configure Exploit Protection
• [ ] Microsoft recommended block rules
• [ ] Control USB devices and other removable media
• [ ] UEFI Hardening (NSA Defensive Practices Guidance) PDF & Hardware-and-Firmware-Security-Guidance
• [ ] Hardware and Firmware Security Guidance for Windows & AMD CPUs - you will find more in the overview
• [ ] Deploy Windows Security Baselines and keep it up2date

For Enterprise/ Company only

• [ ] Application Control (WDAC)
• [ ] Enterprise Certificate Pinning
• [ ] Block untrusted fonts in an enterprise
• [ ] Web protection
• [ ] Protect Remote Desktop credentials with Windows Defender Remote Credential Guard
• [ ] Manage Windows Hello for Business
• [ ] Protect against DLL Search Order Hijacking

Test Config

• Validate connections between your network and the Windows Defender Antivirus cloud service
• Verify client connectivity to Microsoft Defender ATP service URLs
• Validate Windows Defender Tamper protection
• Confirm and validate that Defender "Block at First Sight" (BAFS) is enabled
• Windows Defender Testground
• Windows Defender SmartScreen Demo Pages
• Validate your Kernel DMA Protection
• Test your Antimalware Scan Interface (AMSI)
• Test your Network protection

Reading Material:

• https://github.com/stoptracking/windows10
• https://github.com/frizb/Windows-Privilege-Escalation
• https://github.com/LOLBAS-Project/LOLBAS
• https://github.com/api0cradle/UltimateAppLockerByPassList
• https://trustedwindows.wordpress.com/
• https://docs.microsoft.com/en-us/windows-hardware/drivers/install/early-launch-antimalware
• https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria
• https://docs.microsoft.com/en-us/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10
• https://docs.microsoft.com/en-us/windows/security/
• a picture about Microsoft Defender local and cloud script protection
• a picture about Attack Surface Reduction (ASR) Rules
• Security Unlocked - The Microsoft Security Podcast
• How the hell WD works on Windows Home & Pro documentation from AndyFul
• Windows AppContainer Isolation - what it does? from AndyFul
• Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection
• Windows Defender Application Control (WDAC) Resources
• Why UAC is important at maximum (not default) level: 1, 2, 3, 4, ..
• Testing DLL Search Order Hijacking against security features from AndyFul
• Analysis of Windows 10 - OS Architecture
• Analysis of TPM Integration and UEFI "Secure Boot" in Windows 10
• Analysis of Virtual Secure Mode
• Analysis of Device Guard
• Analysis of Powershell and Windows Script Host