Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only solution, but I thought this could be a learning experience. I created a rule to block the offending IP address from inbound traffic for all applications.
The problem is, as I watch, the same IP address continues to log unsuccessful log in attempts. Does anything else have to happen before a rule goes live? Do I need to restart something? Could another setting be over-ruling the new rule? Thanks