My main gripes are: Lack of meaningful security logging. All configuration changes such as new user, impersonation, and permission escalation should be logged.

My main gripes are: Lack of meaningful security logging. All configuration changes such as new user, impersonation, and permission escalation should be logged. An option should exist to not immediately grant the change but let an admin review and approve. And no. Asking the end user to approve does not cut it. The end user should have his business IT run an automated check. Suzie in marketing does not have the time to understand why the printer driver is asking for full local domain access. Although technically not a part of windows, I view OneDrive as a core component. Its current implementation is beyond confusing. Where is the system of record and where can I retrieve an older version? Is it windows file system, personal OneDrive, or SharePoint? This is magnified when multiple people are editing and another group is reviewing.