I preconfigure all windows machines in my family, and take away their local admin rights. No crapware installs, no disabling of updates or defender. No microsoft accounts.
They get firefox browser with adblocker preinstalled. I manage their important passwords (eg fastmail) and trained them to rely on firefox sync for the recoverable accounts.
I use MeshCentral for remote
administration (amt)… its amazing for the price (free).
OPNsense firewall in all the homes. Unknown devices are isolated and egress over wireguard VPN.
They get firefox browser with adblocker preinstalled. I manage their important passwords (eg fastmail) and trained them to rely on firefox sync for the recoverable accounts.
I use MeshCentral for remote administration (amt)… its amazing for the price (free).
OPNsense firewall in all the homes. Unknown devices are isolated and egress over wireguard VPN.