Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Windows Server 2008 - fully patched.

One of my user accounts keeps getting locked. It is easy enough to unlock it - but it is happening with increasing frequency - and the user is not entering incorrect passwords.

I checked the security log - and see attempts to scan from a specific IP address. I would like to block all activity from this IP address. Is this easy to do? I don't have physical access to the server - so I am hesitant to experiment with setting up a rule that may accidentally block my access.

Also hoping that I can track down specific activity that is causing this user to get locked. Isn't there an event that I can look for when the account gets locked? I don't see it - and this scan that I mentioned above may not be related to the locking - as these 'failed logins' are not for the same user as the user that got locked. We have been watching the logs as the lock happens - but no clues there yet.

share|improve this question
Are there any automated applications that use this users credentials that are trying to authenticate using the previous password or expired credentials? – music2myear Sep 26 '11 at 18:57
No - nothing that is running for that user. I had thought that mapped network drives may be trying to reconnect - but none. – aSkywalker Sep 26 '11 at 19:12
There is malware on the system, Windows firewall blocks All unsolicited incoming connections by default. – Moab Sep 26 '11 at 20:05
up vote 1 down vote accepted

In Windows 7 (I'm hoping this is the same or similar for Server 2008) you can create custom rules in the 'Windows Firewall with Advanced Security'.

In the Inbound rules section create a custom rule that applies to all programs, all ports, and then choose your IP address.

You can see this site for more information.

share|improve this answer
I've done this and there is still traffic on that IP. :/ – marines Jun 8 '14 at 20:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.