I am suffering a low-key dictionary type attack on my SBS server. I can see the failed login attempts in the event viewer but these are only showing the usernames attempted. I would like to see the passwords attempted to see how secure my password policy is. Is this possible?
2 Answers
I think Best Practice today says that not even the system administrator can see passwords, he can only assign new ones.
Therefore, my guess is that passwords used for login attemps are not logged, whether valid or not.
However, I'm quite prepared to be contradicted ...
As a general rule, passwords input by a user are not logged by secure systems, as that in itself would be a security issue, i.e. people with access to system logs may be able to discern others' passwords by referencing their accidental failed logins.
