up vote 1 down vote favorite
share [g+] share [fb]

I have a machine running Windows Server 2003 that is connected to the Internet, and I've noticed several events in the event log that state the following:

The server was unable to logon the Windows NT account 'Administrator' due to the following error: Logon failure: unknown user name or bad password.

The source for this event is MSFTPSVC, and the same event occured about 3 times every second from midnight to 6:30am. It's kind of ridiculous that our server allowed so many attempts. Is there a way to keep someone from attempting to log on after the first few unsuccessful tries?

link|improve this question
40% accept rate
feedback

1 Answer

up vote 0 down vote accepted

Yes, you set this via group policy / computer security policy - however, by default, the Administrator account does not allow lock outs but what I advise you do is rename the administrator account - or disable it.

link|improve this answer
I found it in Administrative Tools / Local Security Policy / Account Policies / Accout Lockout Policy. Is this what you are talking about, or is there another place I need to change it? – Phil Dec 22 '09 at 15:35
It depends - local security policy is fine if this machine is stand alone and it is the local administrator that they are attempting to login as. Otherwise, if it is a domain, you will want to do the domain security policy to change the domain administrator password... As you said Win 2K3, I incorrectly just assumed it was a domain pc. – William Hilsum Dec 22 '09 at 15:59
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.