I would want to consider what kind of laptop it is. For instance a number of years ago Thinkpads added a UEFI setting which can be set to disable the ability o

I would want to consider what kind of laptop it is. For instance a number of years ago Thinkpads added a UEFI setting which can be set to disable the ability of Windows to update firmware. Then I would want to consider what kind of gf she is. These have been around a lot longer than laptops but the tendency of some to function primarily as an "evil maid" is still as prevalent as ever. In that case the laptop is the least of your worries.