Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im looking for a way to monitor our group of servers, so that any failed login attempts (either at the systems keyboard and mouse or via RDP) are brought to my attention, either real time or on a schedule.

to give some background my server group is setup on a workgroup (no domain) and is a mix of windows 2003 servers with one 2008 enterprise system.

all i really want is a method of being alerted when someone trys to login to the server and fails. i know i might get some false positives from people who should be accessing it but have mistyped but i am willing to put up with these to make sure our systems are safe.

ideally if its an application it should be free, but im willing to look at pay software as long as its upto the job.

thanks Kris

share|improve this question

1 Answer 1

I thought that failed login attempts were logged automatically, but I've just tried it and they're not.

However, I have found this page which details the steps for Windows Server 2003. I would expect the process to be very similar if not identical for your 2008 Enterprise machine.

You run "gpedit.msc", then

Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy

Or you can just select Control Panel > Administrative Tools > Local Security Policy > Local Policies > Audit Policy

Then for "Audit account logon events" check "Success" and/or "Failure" depending on which type of attempt you want to monitor. In your case it's "Failure".

I'm not sure how you'd get automatic notification of these, but you can connect to another computer in the Event Viewer. If you didn't have many servers to check you could make it part of your daily routine - but that's far from ideal.

Alternatively you could write a script or small program to periodically check the logs. Check the answers to this question for some ideas.

share|improve this answer
    
To get automatic notifications you can install an event log "watch" product such as Logmeister, Eventmeister, or any one of the myriad products that do this. –  joeqwerty Jun 30 '10 at 15:00
    
@joe - thanks for that. –  ChrisF Jun 30 '10 at 15:12
    
Glad to add my two cents. –  joeqwerty Jun 30 '10 at 18:50
    
thanks for the replies both its been very useful and helpful. –  Kristiaan Jul 2 '10 at 10:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.