Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Windows Server 2008 - fully patched.

One of my user accounts keeps getting locked. It is easy enough to unlock it - but it is happening with increasing frequency - and the user is not entering incorrect passwords.

I checked the security log - and see attempts to scan from a specific IP address. I would like to block all activity from this IP address. Is this easy to do? I don't have physical access to the server - so I am hesitant to experiment with setting up a rule that may accidentally block my access.

Also hoping that I can track down specific activity that is causing this user to get locked. Isn't there an event that I can look for when the account gets locked? I don't see it - and this scan that I mentioned above may not be related to the locking - as these 'failed logins' are not for the same user as the user that got locked. We have been watching the logs as the lock happens - but no clues there yet.

share|improve this question
    
Are there any automated applications that use this users credentials that are trying to authenticate using the previous password or expired credentials? – music2myear Sep 26 '11 at 18:57
    
No - nothing that is running for that user. I had thought that mapped network drives may be trying to reconnect - but none. – aSkywalker Sep 26 '11 at 19:12
    
There is malware on the system, Windows firewall blocks All unsolicited incoming connections by default. – Moab Sep 26 '11 at 20:05
up vote 1 down vote accepted

In Windows 7 (I'm hoping this is the same or similar for Server 2008) you can create custom rules in the 'Windows Firewall with Advanced Security'.

In the Inbound rules section create a custom rule that applies to all programs, all ports, and then choose your IP address.

You can see this site for more information.

share|improve this answer
2  
I've done this and there is still traffic on that IP. :/ – marines Jun 8 '14 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .