The only way I have ever found to run Windows in production is in a virtual machine. I take regular snapshots so that I can restore it when something happens.

I don't suppose you can tell us what you've blocked to get Windows 10 compliant with your security policies?

Edit: I'm genuinely interested... not sarcastic - promise :-)

You should put something out saying what you've blocked, I'm sure many other people want to do the same thing.

I don't know when I'll be able to get off of windows, but I do know that my next computer won't run it on the bare metal. I plan on getting a CPU with good virtualization (non 'k') and only ever running windows inside a VM. Things had already gone too far about 5 revelations ago.

The Intel CPU's with unlocked multi's have had VT-D for a couple iterations now. They're still useless if you have zero plans to overclock. (Even more so now they don't even come with stock coolers anymore.)

Is DragonflyBSD a good desktop environment for someone coming from Debian and other Linux OSs?

Well, the Intel DRM driver is pretty closely tracking linux upstream and most desktop stuff just works, so you could say it's a viable alternative. But it doesn't have DTrace or ZFS, although it has LUKS/dm-crypt for compatibility with Linux and the Hammer1 filesystem provides most of ZFS (missing some important bits) while requiring much much less RAM. You can actually dedup your Hammer filesystem with little RAM. Matt's been working for a long time on Hammer2 and it's still under heavy development. The message passing, less sharing concurrency in the kernel allowed Dragonfly to be competitive with Linux in benchmarks with just a few developers and a simpler kernel locking scheme altogether. DTrace is the number one feature I miss compared to FreeBSD, but other than that it's great. But FreeBSD gets a lot more contributions so is a much safer bet for production and they're also well on their way to have a linux abstraction layer for quicker sync of kernel drm drivers. So they will soon close up to Dragonfly in terms of Intel and Radeon graphics support. Also FreeBSD gets official Nvidia binary drivers if you need them and they have a kernel driver ABI that doesn't require you to rebuild nvidia.ko.

You don't know about the "Security" telemetry level and why it is there? Server has it too BTW.