For VBA macros, I haven't seen one get past email security in at least a year and half, attackers are favoring Excel 4 macros from what I have seen but I guess for non-big-corporate users VBA macros must still be a problem. Attackers also just put in a link to the malware/archive instead of using a macro but overall this is progress. Signed macro enforcement via GPO would even be better.
For RDP, ugh.... yeah. Lockouts are kind of a problem, I had to deal with this months ago. Lockouts bu themselves are a security issue because availability is a security property. Now, if Microsoft allowed RDP to have OpenSSH like controls about how many failed attempts result in a delay that would be nice. What would be even better would be password policy enforcement especially and specifically for the RDP local group. And password spray protection for domain accounts (if an IP fails login from multiple hosts, temporarily block the IP instead of locking the account). My last wishlist would be public key authentication that is easy to setup like SSH.
You can easily enforce password policy for weak passwords but this lockout policy is useless if they are spraying leaked/known passwords against many accounts, if I understand correctly all you have to do is avoid repeat login attempts for any one account within a 10min window? Which makes it harder but still practical.
For RDP, ugh.... yeah. Lockouts are kind of a problem, I had to deal with this months ago. Lockouts bu themselves are a security issue because availability is a security property. Now, if Microsoft allowed RDP to have OpenSSH like controls about how many failed attempts result in a delay that would be nice. What would be even better would be password policy enforcement especially and specifically for the RDP local group. And password spray protection for domain accounts (if an IP fails login from multiple hosts, temporarily block the IP instead of locking the account). My last wishlist would be public key authentication that is easy to setup like SSH.
You can easily enforce password policy for weak passwords but this lockout policy is useless if they are spraying leaked/known passwords against many accounts, if I understand correctly all you have to do is avoid repeat login attempts for any one account within a 10min window? Which makes it harder but still practical.