Sam is a Windows system administrator responsible for setting up client workstations for different departments. After installing the operating system, Sam manually disables certain programs that are not needed by that department. Recently, Sam learned a few workstations had been compromised. The security analyst suggests that the disabled applications may have been the target. Going forward, what should Sam change in his process?