My Administrator user once in a while is getting locked-out by the workstations in our lab, due to failed logon attempts.
(While this is a problem that should be addressed, because this means there is something wrong with the techies process, it's a small and less important at the moment)
My main problem is that the Administrator can authenticate from anywhere in the network.
I've tried using GPO ("Deny log on through Remote Desktop Services"), ADUC ("Log On To" list).
While he can't actually logon, the authentication is performed first and only then the system checks if there's a GPO or an ADUC block, thus allowing the Administrator user to get locked-out.
Of course this problem can apply to any user.
My Domain\Forest level is 2008r2, and I don't have a firewall between my LAN and my DC.
So, in short, I want to allow authentication attempts of the Administrator only from a certain computers.
Any suggestions?
this means there is something wrong with the techies process, it's a small and less important at the moment
- you're trying to find a technical solution to a people/process problem. If you fix the people/process problem you wouldn't need to look for a technical solution, so why not fix the root cause of the problem instead of going on a wild goose chase?Administrator
account in your question. That is theuser account in question
. If you exempt that account from the account lockout policy and that account is compromised then you've just opened yourself up to a world of hurt because you've exempted that account from the policy that would prevent a brute force attack originating from that account.