[londons_explore]

> specifically blocks ransomware

If microsoft made the "shadow copy"/"previous versions"/"system restore" functionality a core part of the kernel that even someone with admin rights can't mess with (which it almost is already), then that could be used to roll the system back to 5 mins before ransomware infection easily.

[kevingadd]

Ransomware usually has delayed activation built in, so that it's possible for it to spread or activate simultaneously once it's encrypted a bunch of machines, afaik