Windows 11 now has much better protection against brute-force attacks TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. Windows 11 now has much better protection against brute-force attacks By Sead Fadilpašić published 22 September 2022 It's going to take a lot more time to try out numerous combinations (Image credit: Shutterstock) Audio player loading… Microsoft's SMB server service on Windows 11 has been given an update aimed at making it better at defending against brute-force attacks. In the operating system's latest Windows 11 2022 update, the Insider Preview Build 25206, recently pushed to the Dev Channel, SMB authentication rate limiter is enabled by default. What's more, a couple of other settings have been tweaked to make these attacks "less effective". Unattractive target "With the release of Windows 11 Insider Preview Build 25206 Dev Channel today, the SMB server service now defaults to a 2-second default between each failed inbound NTLM authentication," Ned Pyle, Principal Program Manager in the Microsoft Windows Server engineering group, said in a blog post (opens in new tab) announcing the news. "This means if an attacker previously sent 300 brute force attempts per second from a client for 5 minutes (90,000 passwords), the same number of attempts would now take 50 hours at a minimum." In other words, by toggling the feature on, there is a delay between each unsuccessful NTLM authentication attempt, making the SMB server service more resilient to brute-force attacks. "The goal here is to make a Windows client an unattractive target either when in a workgroup or for its local accounts when joined to a domain," Microsoft's Amanda Langowski and Brandon LeBlanc chimed in. The authentication rate limiter, which is not enabled by default, was first introduced to Windows Server, Windows Server Azure Edition, and Windows 11 Insider builds, some six months ago. The SMB server, on the other hand, does launch automatically on all versions. It needs to be exposed to the internet, though, by manually opening a firewall. Read more> Brute-force attacks targeting MSSQL servers, Microsoft warns > Microsoft sounds the alarm over new wave of password spraying attacks > These are the best firewalls right now (opens in new tab) Those interested in trying out the new feature need to run this PowerShell command: Set-SmbServerConfiguration -InvalidAuthenticationDelayTimeInMs n "This behavior change has no effect on Kerberos, which authenticates before an application protocol like SMB connects. It is designed to be another layer of defense in depth, especially for devices not joined to domains such as home users," Pyle also saidThese are the best endpoint protection (opens in new tab) services right now Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me2Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie3Google Pixel Tablet is what Apple should've done ages ago4RTX 4090 too expensive? Nvidia resurrects another old favorite5Blizzard made me explain Overwatch 2 smurfing to my mum for nothing1Best laptops for designers and coders 2The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me3Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie4iPhone 15 tipped to come with an upgraded 5G chip5Google Pixel Tablet is what Apple should've done ages ago Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)