A certain computer in my LAN has been hammering the Domain Controller with event 4768 (authentication failure). After conferring with the 'owner' of that computer, it's found out that there's a malware in that computer.

We plan on copying the important data (files) onto a newly built server, and zap this one. In the meanwhile, I want to block it completely from the DC. However, adding a new Inbound Rule (nothing explicitly specified except "Remote Address", in which I put the IP address of the computer) does not seem to help; event 4768 keeps appearing.

Where did I go wrong? Why won't Windows Firewall block that infected computer?

The DC in question is a Windows Server 2008 R2, by the way.


Okay, stupid me. Someone turned off Windows Firewall via GPO. As soon as I turn it back on, everything goes well.

Now excuse me while I find out who the perpetrator is...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.