---
title: New Windows 11 Security Feature to Limit Ransomware Attacks
description: Microsoft has plans to implement a default security feature in Windows 10 and 11 that will help prevent ransomware attacks and other account takeovers.
---

[SecureWorld News ](https://www.secureworld.io/industry-news)

# [New Windows 11 Security Feature to Limit Ransomware Attacks](https://www.secureworld.io/industry-news/windows-11-security-feature-block-attacks)

 Written by [Drew Todd](https://www.secureworld.io/industry-news/author/drew-todd) | Mon | Jul 25, 2022 | 10:41 PM Z

Microsoft has revealed plans for a new security default in Windows 11 that will help defend against credential stuffing and brute force attacks that aim to access remote desktop protocol (RDP) endpoints.

The security feature will automatically lock accounts for 10 minutes after 10 invalid sign-in attempts.

This new default feature is part of Microsoft's plan to raise the [security baseline](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines) to meet the constantly changing threat landscape.

Ransomware operators are surely not happy with this update, as RDP remains one of the top methods for initial access in ransomware deployments, with many cyber gangs specializing in compromising RDP endpoints and selling them to others for access, according to a report from [ZDNet](https://www.zdnet.com/article/windows-11-is-getting-a-new-security-setting-to-block-ransomware-attacks/).

David Weston, Vice President of OS Security and Enterprise at Microsoft, shared this tweet last week:

> [@windowsinsider](https://twitter.com/windowsinsider?ref_src=twsrc%5Etfw) Win11 builds now have a DEFAULT account lockout policy to mitigate RDP and other brute force password vectors. This technique is very commonly used in Human Operated Ransomware and other attacks - this control will make brute forcing much harder which is awesome! [pic.twitter.com/ZluT1cQQh0](https://t.co/ZluT1cQQh0)
> 
> — David Weston (DWIZZZLE) (@dwizzzleMSFT) [July 20, 2022](https://twitter.com/dwizzzleMSFT/status/1549870156771340288?ref_src=twsrc%5Etfw)

In response, Kevin Beaumont, a popular security researcher in the U.K. who has over 140,000 followers on Twitter, thanked David and said he now owes him a beer:

> oh my god, they're doing the RDP entry issue - between macros and RDP this makes almost all Windows/MS ransomware entry.
> 
> I owe Dave a beer
> 
> (...once it's backported to older OSes and generally available...)[https://t.co/u9k80jSLns](https://t.co/u9k80jSLns)
> 
> — Kevin Beaumont (@GossiTheDog) [July 21, 2022](https://twitter.com/GossiTheDog/status/1550064598908370944?ref_src=twsrc%5Etfw)

 

Researchers say that this update is "big news" and parallels Microsoft's default block on internet macros. For years, internet macros in Microsoft Office have been some of the primary vectors for ransomware operators, as this allows them to conduct attacks through email attachments and links.

Microsoft has not officially announced how it will roll out the new security default to Windows 10 and 11, but it is possible we will see it in an upcoming security update soon.

Weston said the feature should initially be available in the Windows 11 Insider preview build 22528.1000 and upwards.   

[View full post](https://www.secureworld.io/industry-news/windows-11-security-feature-block-attacks)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Drew Todd"
  },
  "dateModified" : "2022-07-25T22:41:27.923Z",
  "datePublished" : "2022-07-25T22:41:27Z",
  "headline" : "New Windows 11 Security Feature to Limit Ransomware Attacks",
  "image" : {
    "@type" : "ImageObject",
    "height" : 720,
    "url" : "https://info.secureworld.io/hubfs/social-suggested-images/windows-1859187_1280.jpg",
    "width" : 1280
  },
  "mainEntityOfPage" : "https://www.secureworld.io/industry-news/windows-11-security-feature-block-attacks",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2221756/Logos/SWE/SWE_logo_full-long_forWHITEbackgrounds.jpg",
      "width" : 304.46954
    },
    "name" : "SecureWorld News"
  }
}
```