Currently we set _WIN32_WINNT at various places in the codebase; this is used to target a minimum Windows version we want to support. See also for more detailled information :
https://docs.microsoft.com/en-us/windows/win32/winprog/using-the-windows-headers?redirectedfrom=MSDN#setting-winver-or-_win32_winnt
Macros for Conditional Declarations
"Certain functions that depend on a particular version of Windows are declared using conditional code. This enables you to use the compiler to detect whether your application uses functions that are not supported on its target version(s) of Windows."

However currently we have quite a lot of differing settings of _WIN32_WINNT in the codebase ; setting _WIN32_WINNT to 0x0601 (Windows 7) where possible would make sense because we have this setting already at one place (so targetting older Windows versions at other places is most likely not useful).

While looking at the codebase, it was found that at least in jdk\src\jdk.crypto.mscapi\windows\native\libsunmscapi\security.cpp already Windows 8 APIs are needed, otherwise we get :

d:\a\jdk\jdk\jdk\src\jdk.crypto.mscapi\windows\native\libsunmscapi\security.cpp(1262): error C2065: 'NCRYPT_CIPHER_KEY_BLOB': undeclared identifier
d:\a\jdk\jdk\jdk\src\jdk.crypto.mscapi\windows\native\libsunmscapi\security.cpp(1280): error C2065: 'NCRYPT_PROTECTED_KEY_BLOB': undeclared identifier

Reason is that already for some time ( at least OpenJDK 11) we have an implicit minimum requirement of Windows 8 / Windows 2012
APIs for this code, so enforcing Win 7 is too old; see also
https://docs.microsoft.com/en-us/windows/win32/api/ncrypt/nf-ncrypt-ncryptexportkey

NCRYPT_PROTECTED_KEY_BLOB
Export a protected key in a NCRYPT_KEY_BLOB_HEADER structure.
Windows 8 and Windows Server 2012: Support for this value begins.

(same for NCRYPT_CIPHER_KEY_BLOB)

So we need -D_WIN32_WINNT=0x0602 to build this coding.