A company would like to increase its security measures because a workstation was recently hacked. Which of the following would offer the BEST protection from unauthorized access of workstations?

Strong passwords reduce the risk of credential-based attacks but do not prevent access if credentials are stolen, guessed, or bypassed through a vulnerability.

Restricting user permissions enforces the principle of least privilege, ensuring that even if an attacker gains access, they are confined to only what that account is authorized to do. This limits lateral movement, prevents privilege escalation, and reduces the blast radius of a breach. It is the most direct and sustainable control against unauthorized workstation access.

Encrypting the filesystem protects data confidentiality at rest but does not prevent an authenticated attacker from accessing the system or its data once logged in.

Disabling AutoRun prevents malware from launching automatically from removable media but does not restrict who can log in or what they can do once on the workstation.