I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout.
What is the best way to do this?
I have the following group policy:
Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\
- Account Lockout duration 10 mins
- Account lockout threshold 5 attempts
- Reset Account lockout counter after 10 mins