Never mind hardening windows, how about stopping Windows update behaving like some sort of particularly malicious malware by forcing me to rebuild my machines at random after an update? AU forced one machine to be fully reinstalled, last week's update rendered another machine inoperable with admin access denied on windows system programs (mmc etc.) followed by boot device error (disc was fine) with no restore or roll-back available, so had to rebuild that one too. Getting very tempted to set windows update addresses to point to Host.