A certain computer in my LAN has been hammering the Domain Controller with event 4768 (authentication failure). After conferring with the 'owner' of that computer, it's found out that there's a malware in that computer.
We plan on copying the important data (files) onto a newly built server, and zap this one. In the meanwhile, I want to block it completely from the DC. However, adding a new Inbound Rule (nothing explicitly specified except "Remote Address", in which I put the IP address of the computer) does not seem to help; event 4768 keeps appearing.
Where did I go wrong? Why won't Windows Firewall block that infected computer?
The DC in question is a Windows Server 2008 R2, by the way.