I am using Windows Server 2008 - fully patched.
One of my user accounts keeps getting locked. It is easy enough to unlock it - but it is happening with increasing frequency - and the user is not entering incorrect passwords.
I checked the security log - and see attempts to scan from a specific IP address. I would like to block all activity from this IP address. Is this easy to do? I don't have physical access to the server - so I am hesitant to experiment with setting up a rule that may accidentally block my access.
Also hoping that I can track down specific activity that is causing this user to get locked. Isn't there an event that I can look for when the account gets locked? I don't see it - and this scan that I mentioned above may not be related to the locking - as these 'failed logins' are not for the same user as the user that got locked. We have been watching the logs as the lock happens - but no clues there yet.