Ask HN: How do I properly secure a windows server machine using FOSS tools?

I manage a windows server machine for a small business. I do it part time for my brother's business. I've enabled usual protection suggested by Microsoft like regular scan, backup, write protection in certain folders with whitelist etc. Are there FOSS tools that I can use to manage, monitor and secure Windows machine. His office also has 7-8 windows laptops connecting to this "server" which is just a powerful AMD desktops class machine with good storage and memory. How can I manage this small fleet and secure them also?