Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine running Windows Server 2003 that is connected to the Internet, and I've noticed several events in the event log that state the following:

The server was unable to logon the Windows NT account 'Administrator' due to the following error: Logon failure: unknown user name or bad password.

The source for this event is MSFTPSVC, and the same event occured about 3 times every second from midnight to 6:30am. It's kind of ridiculous that our server allowed so many attempts. Is there a way to keep someone from attempting to log on after the first few unsuccessful tries?

share|improve this question
up vote 0 down vote accepted

Yes, you set this via group policy / computer security policy - however, by default, the Administrator account does not allow lock outs but what I advise you do is rename the administrator account - or disable it.

share|improve this answer
    
I found it in Administrative Tools / Local Security Policy / Account Policies / Accout Lockout Policy. Is this what you are talking about, or is there another place I need to change it? – Phil Dec 22 '09 at 15:35
    
It depends - local security policy is fine if this machine is stand alone and it is the local administrator that they are attempting to login as. Otherwise, if it is a domain, you will want to do the domain security policy to change the domain administrator password... As you said Win 2K3, I incorrectly just assumed it was a domain pc. – William Hilsum Dec 22 '09 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .