Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to receive an email any time a failed login attempt occurs on our Windows 2003 server. What is the easiest way to accomplish this?



share|improve this question
up vote 2 down vote accepted

I'm not going to post the entire script again, but my answer here contains a script that will do what you're looking for. If you're looking for domain logon failures you'll need to install it on every domain controller since user logons can be processed by any DC.

I agree w/ mrdenny on this one, though. You could get a lot of email coming in quickly. That script has no rate-limiting capability in it (hey-- it's free), so be careful with it if you use it in production because an attacker could create a slew of email for you very quickly.

share|improve this answer

You would to audit all those failures, then setup a monitoring application to read the security log and trigger on that alert message.

Depending on the size of your company you could end up with a LOT of email coming in very quickly.

share|improve this answer

We simply created a VBScript to poll the event log, place all bad logins for the last 15 minutes into an array, removed duplicates whilst maintaining a duplicate count, and then email that list out. We then scheduled the script to run every 15 minutes.

share|improve this answer

I'd just like to add that it's not the failed logons you need to worry about. A failed logon is just a sign that your security is working; no concerns (although certain patterns of multiple failed logons are an indicator that someone or something is trying to brute force you).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.