Microsoft provides advice on security settings in this regard. One setting you might want to enable is the Potentially Unwanted Application (PUA) feature. You can enable PUA protection with Microsoft Intune, System Center Configuration Manager, Group Policy, PowerShell or with registry keys. Enabling this setting ensures that drive-by downloads wont trick users to install on your systems. These settings are functional in Windows 10 Professional and you do not need Defender ATP or Enterprise licenses to enable this setting.”]