Which of the following options in Windows is the best way to secure a workstation?

A screensaver alone locks a screen after a timeout but is trivially bypassed if no password is required to unlock it, making it a weak secondary control.

User education is a procedural control that reduces risk through behavior change but is not a direct technical enforcement mechanism on the workstation.

Disabling Autorun prevents malware from executing automatically from removable media but does not restrict who can log into the system.

A complex password - combining uppercase, lowercase, numbers, and special characters at sufficient length - is enforced at the Windows authentication layer and is the primary barrier preventing unauthorized users from logging into the workstation. It is a direct, software-enforced technical control that applies every time access is attempted. Windows Group Policy can enforce complexity requirements and expiration to maintain this protection consistently.

An ID badge is a physical access control for entering a facility or room and does not control access to the Windows operating system itself.

A key fob is a hardware authentication token that may supplement login but is not a built-in Windows workstation security feature by default.

Retinal scan is a biometric control that requires specialized hardware not standard on workstations and is not a native Windows security option.