Robust and practical allowlisting rules for Windows using AppLocker, Office macro controls, and some WDAC to close a couple of known gaps ...