Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am receiving a lot of failed login attempts (1 per sec) on a Windows 2008 server, I have already set local security policy to automatically lock an account after too many login attempts, but is there a way to automatically include an IP adress in the Windows firewall so that it will be blocked temporarily (say for 30 minutes) ?

share|improve this question
You're approaching this problem from the wrong perspective. If you're getting failed logon attempts that frequently you need to find the source (available in the security log) and fix it. Blocking an IP temporarily because it's flooding your server with logon attempts is only going to mask the problem temporarily. – Chris McKeown Jan 19 '13 at 21:11
@ChrisMcKeown I don't follow what you're implying by 'source' in your comment. Do you mean the service that's open on the server or something else? I see the question as quite valid and on Unix machines I block repeated offenders as well all the time. – mikebabcock Jan 19 '13 at 22:42
The failed logon attempt has to come from somewhere, be it a user or a service or executable running as a particular user. The source (i.e. the remote machine that is attempting the logon) will be recorded in the security log. Failed attempts at the rate of one per second is probably something that warrants further investigation rather than simply blocking the source for a little while (what does that achieve?) – Chris McKeown Jan 19 '13 at 22:48
To answer above, my event log shows many different IP adresses from all over the world. I started adding some of them manually to a block list on the firewall, but an automatic way would be welcome. I am not wanting to exclude ranges, to prevent excluding valid IP's. The only reason to unblock after some time, is because I might exclude gateways which again could have other valid users. I only want to discourage any hack attempt. – Allie Jan 20 '13 at 2:10

We were recently flooded with similar attempts and had great success with fail2ban which does precisely that: blocks a source IP after N failed login attempts.

While it's designed for linux, a great answer by Evan Anderson to the ServerFault question Does fail2ban do Windows? may help you implement it.

share|improve this answer

If this is an "internal" issue then I would suggest you follow the advice listed above and find the user/device/service which is essentially trying to brute force its way in and solve the problem. If this is a remote login coming from outside then there are a number of different programs/scripts that will "ban" an IP for a number of hours or days so they cannot complete their attack. One of those scripts is written by a member here.

How to stop brute force attacks on Terminal Server (Win2008R2)?

share|improve this answer
The issue is global as I get the failed login events from all over the world. You are providing me a solution that could work for me. I will have a better look at it. – Allie Jan 20 '13 at 2:17

How are these external logon attempts able to reach your server in the first place? Is the server running a website with authentication enabled or something like that? What services are you running that need to be exposed to the outside world from this server? If it's Remote Desktop then personally I'd consider using a VPN instead.

share|improve this answer
You have a good point. This is a server which is a public webserver, without any authentication needed, but with Remote Desktop Service to be able to manage it. I think you are right that Remote Desktop should only be accessible through VPN, and that would end my problem.. (now I need to find a way HOW to do that :) ) – Allie May 29 '13 at 17:17

protected by Chris S Mar 21 '13 at 13:28

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.