I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout.

What is the best way to do this?

I have the following group policy:

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\

  • Account Lockout duration 10 mins
  • Account lockout threshold 5 attempts
  • Reset Account lockout counter after 10 mins

That's good enough if you have a reasonable password policy. If people can have a password of 1, that's probably going to be a problem.

You've rate limited brute forcing the password to 1 password every 2 minutes. At that rate guessing a 7 character, all numbers password would take 19 years of straight hacking on average... and that's a pretty crappy password.

| improve this answer | |
  • 2
    Yeah. And welcome to a DDOS world where your people are locked out constantly ;) – TomTom Jan 15 '13 at 12:01

While what Chris S says its true, you have opened yourself up to a DOS attack. I can't break into your accounts, but I can lock them all out permanently. I just keep on doing wrong password attempts, indefinitely. One bad attempt per user, every 2 minutes isn't much.

You need something monitoring your logs for invalid attempts, and eventually block that IP address at the firewall for a period of time.

How to set that up is highly dependent on your infrastructure (logging, firewall, etc), and your usage patterns. For instance if the same IP address makes a invalid attempt on 2-3 accounts, you may want to block that IP for a few days. If its one account, you may only want to block that IP once its done 10 invalid attempts in an hour, for two hours.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.