So they needed physical access to the device first, than had to run a file from a network share to “infect” Windows 10 S — any network admin worth his salt would have already flagged that file and not allowed it inside their network. Also any admin would disable macros on outside files, and mark the files read only and not allow macros to be enabled to begin with. Need to edit the file? OK save as a new file and BTW all formatting and macros will be lost as it will come over as a text only file, apply your own formatting. Problem solved.