> I’m not talking about admin privileges. Every user process has full access to all files and registry. UWP was a step to the right direction, but it’s too little, too late.
Operating system should be out of bounds even for the “administrator”. Applications should not be able to install arbitrary programs as services, even when they run as administrators. Service binaries should be required to bear MS signature, like kernel drivers are.