Limiting the attack surface on Windows