I have found that the group policy for Windows Update: “No auto-restart with logged on users for scheduled automatic updates” does still work for Win 10 if the policy “Configure Automatic Updates” is configured to perform scheduled installations of updates (Option 4). I have it set up this way and users are notified and can choose to reboot, schedule the reboot, or even ignore. The update policies can be confusing and contradict each other so configure as few of these policies as possible.

Veeam endpoint backup is free and creates image and bootable CD to make full recovery easier including drivers. It does incremental on schedule keeping configurable number of daily versions available. Individual file restore easily accomplished.

I read about this yesterday on ZDNet, it's probably not a macro, but an image (install Silverlight) that points to a Visual Basic Script instead of a URL which installs the keylogger. Details: [^]