Don't let people log into it, install updates. But it's usually the user data that's the problem, and that's shared to all the other users. So don't let users

Don't let people log into it, install updates. But it's usually the user data that's the problem, and that's shared to all the other users. So don't let users run unauthorised code by using SRP/Applocker