Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout.

What is the best way to do this?

I have the following group policy:

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\

  • Account Lockout duration 10 mins
  • Account lockout threshold 5 attempts
  • Reset Account lockout counter after 10 mins
share|improve this question
up vote 7 down vote accepted

That's good enough if you have a reasonable password policy. If people can have a password of 1, that's probably going to be a problem.

You've rate limited brute forcing the password to 1 password every 2 minutes. At that rate guessing a 7 character, all numbers password would take 19 years of straight hacking on average... and that's a pretty crappy password.

share|improve this answer
Yeah. And welcome to a DDOS world where your people are locked out constantly ;) – TomTom Jan 15 '13 at 12:01

While what Chris S says its true, you have opened yourself up to a DOS attack. I can't break into your accounts, but I can lock them all out permanently. I just keep on doing wrong password attempts, indefinitely. One bad attempt per user, every 2 minutes isn't much.

You need something monitoring your logs for invalid attempts, and eventually block that IP address at the firewall for a period of time.

How to set that up is highly dependent on your infrastructure (logging, firewall, etc), and your usage patterns. For instance if the same IP address makes a invalid attempt on 2-3 accounts, you may want to block that IP for a few days. If its one account, you may only want to block that IP once its done 10 invalid attempts in an hour, for two hours.

share|improve this answer
You make a good point. I've decided to make a new question to focus on the DOS issue.… – SLY Jan 26 '11 at 19:57

protected by Community Jan 15 '13 at 14:04

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.