Microsoft releases a new default policy to thwart credential attacks, which is also heading to Windows 10.