The key is to treat Windows users like children and lock it down with an administrator password. You’d be amazed how well Windows holds up over the years if you just prevent them from installing whatever random bullshit they find.