Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am suffering a low-key dictionary type attack on my SBS server. I can see the failed login attempts in the event viewer but these are only showing the usernames attempted. I would like to see the passwords attempted to see how secure my password policy is. Is this possible?

share|improve this question

I think Best Practice today says that not even the system administrator can see passwords, he can only assign new ones.

Therefore, my guess is that passwords used for login attemps are not logged, whether valid or not.

However, I'm quite prepared to be contradicted ...

share|improve this answer

As a general rule, passwords input by a user are not logged by secure systems, as that in itself would be a security issue, i.e. people with access to system logs may be able to discern others' passwords by referencing their accidental failed logins.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.