I have a machine running Windows Server 2003 that is connected to the Internet, and I've noticed several events in the event log that state the following:

The server was unable to logon the Windows NT account 'Administrator' due to the following error: Logon failure: unknown user name or bad password.

The source for this event is MSFTPSVC, and the same event occured about 3 times every second from midnight to 6:30am. It's kind of ridiculous that our server allowed so many attempts. Is there a way to keep someone from attempting to log on after the first few unsuccessful tries?


Yes, you set this via group policy / computer security policy - however, by default, the Administrator account does not allow lock outs but what I advise you do is rename the administrator account - or disable it.

  • I found it in Administrative Tools / Local Security Policy / Account Policies / Accout Lockout Policy. Is this what you are talking about, or is there another place I need to change it? – Phil Dec 22 '09 at 15:35
  • It depends - local security policy is fine if this machine is stand alone and it is the local administrator that they are attempting to login as. Otherwise, if it is a domain, you will want to do the domain security policy to change the domain administrator password... As you said Win 2K3, I incorrectly just assumed it was a domain pc. – William Hilsum Dec 22 '09 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.