@op & @EasyTiger_ Well an example are the improvements to the various authentication implementations, the fact that I can now finally configure my personal wor

@op & @EasyTiger_ Well an example are the improvements to the various authentication implementations, the fact that I can now finally configure my personal workstation to be impervious to certain types of pass-the-hash attacks. A nice matrix that illustrates the improvements can be found here: https://pbs.twimg.com/media/BfZw8iiCQAApq0T.png https://pbs.twimg.com/media/BfZw8iiCQAApq0T.png Where 'green' is secure, as you can see a 'domain protected user' in windows 10 protects against almost every type of attack. These I have personal experience with from the attackers perspective, and windows 2012 domains are quite impervious to attacks that used to own the entire domain in as little as 2 hours. Not to mention that in addition to the matrix shown here, traditional psexec has finally been restricted to a special group of users, so that local administrators can no longer remotely take possession of a system unless explicitly configured to be able to. Most of those improvements are really only applicable to enterprise, and some of them came about by switching to a more secure default (instead of new technolly). New in windows 10 is also control flow guard (CFG), which most applications that I run at home and work already support. With the new addition of CFG use after free exploits should be harder to achieve on windows 10 than windows 7, although I don't have any personal experience with developing exploits for windows 10 yet. In addition to the general improvements to credential protection and CFG, windows 10 is further isolating critical system components from each other in the kernel. I haven't experimented/looked at it in any detail yet, but I get the impression it's conceptually similar to qubes OS. In windows 7 the kernel patch protector (KPP) ran in ring 0, just like al l the other kernel code, if you got code execution you could simply patch KPP too, and then your rootkit had free roam over the kernel. Now Microsoft claims that in windows 10 KPP has been isolated so that normal 'ring 0' (if that still means anything in the traditional sense) can no longer patch it.