Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A certain computer in my LAN has been hammering the Domain Controller with event 4768 (authentication failure). After conferring with the 'owner' of that computer, it's found out that there's a malware in that computer.

We plan on copying the important data (files) onto a newly built server, and zap this one. In the meanwhile, I want to block it completely from the DC. However, adding a new Inbound Rule (nothing explicitly specified except "Remote Address", in which I put the IP address of the computer) does not seem to help; event 4768 keeps appearing.

Where did I go wrong? Why won't Windows Firewall block that infected computer?

The DC in question is a Windows Server 2008 R2, by the way.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Okay, stupid me. Someone turned off Windows Firewall via GPO. As soon as I turn it back on, everything goes well.

Now excuse me while I find out who the perpetrator is...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.