Windows Attack Surface Reduction (ASR) is an excellent method to improve the security of your Windows devices for free. It is not generally enabled by default and my free script here:
https://github.com/directorcia/Office365/blob/master/win10-asr-get.ps1
enables you to quickly see whether all the ASR rules are enabled for your Windows device.
The script also has other reference links you can use if you then wish to enable ASR in your environment. Always be careful enabling something like this without at least putting it in audit mode first to determine any impact in your production environment.
The video run through above and here:
https://www.youtube.com/watch?v=1KLGsNuz088
hopefully give you a better idea about what the script can accomplish for you.
CIAOPS 