My Administrator user once in a while is getting locked-out by the workstations in our lab, due to failed logon attempts.
(While this is a problem that should be addressed, because this means there is something wrong with the techies process, it's a small and less important at the moment)

My main problem is that the Administrator can authenticate from anywhere in the network.
I've tried using GPO ("Deny log on through Remote Desktop Services"), ADUC ("Log On To" list).
While he can't actually logon, the authentication is performed first and only then the system checks if there's a GPO or an ADUC block, thus allowing the Administrator user to get locked-out.

Of course this problem can apply to any user.
My Domain\Forest level is 2008r2, and I don't have a firewall between my LAN and my DC.

So, in short, I want to allow authentication attempts of the Administrator only from a certain computers.
Any suggestions?

  • 1
    this means there is something wrong with the techies process, it's a small and less important at the moment - you're trying to find a technical solution to a people/process problem. If you fix the people/process problem you wouldn't need to look for a technical solution, so why not fix the root cause of the problem instead of going on a wild goose chase? – joeqwerty Jan 18 '15 at 17:20
  • @joeqwerty Simply because the same problem can occur anywhere in the network (as well as in a form of brute-forcing attack). Also, I know that about myself that I usually try the technical solution first (even when it's quite clear that it's more of a people problem), since the people in my workplace aren't very disciplined and tech-savvy (yes, even the techies in the lab). But I suppose I'll have to do the people solution... – EliadTech Jan 18 '15 at 17:25
  • How is your proposed solution relevant to a brute force attack? You're looking to solve this for a particular user account(s) so how would that be relevant to a brute force attack? If the user account in question were compromised you would have just opened the door for a brute force attack by exempting this user account from the account lockout policy. So it seems to me that, again, the right solution is to fix the people/process problem. – joeqwerty Jan 18 '15 at 17:31
  • @joeqwerty I'm was looking to do that for all important accounts (Admins, Service accounts, etc.). You're right that this is not the way to block brute-force properly, but that's a start. Also, didn't understand "If the user account in question ..." – EliadTech Jan 18 '15 at 17:39
  • You referred to the Administrator account in your question. That is the user account in question. If you exempt that account from the account lockout policy and that account is compromised then you've just opened yourself up to a world of hurt because you've exempted that account from the policy that would prevent a brute force attack originating from that account. – joeqwerty Jan 18 '15 at 17:45

You cannot do this, unless you start blocking ports, which won't be limited to a specific user. Sorry. Think of it this way - a Windows system doesn't know who a connecting user is, until they authenticate.

| improve this answer | |
  • You're right. So my question should have been if there's a way, when authenticating, to send the username in clear-text (instead inside a hash along with the password) so a firewall (or whatever) can catch it. But now it just turned to a merely theoretical question, because my workplace won't be giving me any new firewall any time soon... – EliadTech Jan 18 '15 at 17:27
  • Yes there is, depending on the application and your firewall. Their are plenty of firewalls that can do pre-authentication for things like forms-based authentication and maybe even NTLM or Kerberos; and depending on the capabilities, you could restrict it to not allow certain usernames. Whether or not it would still complete the pre-authentication is an implementation detail of the firewall; if it did, you'd still be getting bad password attempts and a lockout. As you're aware, you need to fix the real problem. – mfinni Jan 18 '15 at 17:30

Anyone can attempt to authenticate from any workstation. By way of analagy, you are trying to prevent the janitor from putting the wrong key in any door. The only way stop that is to prevent the janitor from doing so is to simply tell him which key in what door, but you can't stop him from trying without physically stopping him. I'm not sure why you brought up firewall but that's not going to help you either. What might help is not logging in as admin, but rather elevating into it. UAC can help with that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.