Windows Server Article Categories

Create an Account Lockout Policy

Posted in Windows 7, Windows Vista, Windows Server by Steve Sinchak

In my last article I showed you how you can protect your computer against anonymous user account attacks by turning on account logon auditing so you could see when someone attempts to remotely logon to your account.  Now I am going to help your increase your level of protection with the Account Lockout Policy.

Creating an Account Lockout Policy will protect your account by limiting the number of time a remote application or attacker can try to guess your password.  This works by automatically locking out your account after a designated number of incorrect passwords were entered.  Your account will remain locked out for a designated period of time before it is automatically unlocked and it can be logged into again.  This provides a valuable addition to your account security because it can render brute force password attacks useless.  If you have your lockout threshold set to 4 bad attempts and the lockout duration to 15 minutes, an attacker can try to guess your password a maximum of 16 times per hour. 

Now that you know how valuable an Account Lockout Policy is, let’s get it setup on your computer:

  1. Click on the Start Button and key in Secpol.msc and hit Enter.
  2. Navigate through Account Policies and Account Lockout Policy.
  3. Right click on Account lockout threshold and select Properties.
  4. Enter in the value you want to use and hit OK to save. I like to use 4 here. 
  5. Windows will set the default values for the lockout duration and Reset account lockout counter values.  If you want to change these values from the defaults (30 minutes), right click on them and select Properties. After making your changes hit OK to save and exit.  

Read More

Turn on auditing to monitor account attacks

Posted in Windows 7, Windows Vista, Windows Server by Steve Sinchak

There is no doubt that all of the new security features in the modern versions of Windows will help keep your computer more secure.  However, these features become less valuable when they are not turned on by default.  One feature, known as user account auditing, is not turned on by default. With this feature is turned off, anyone with physical access or remote access to through a hole in your firewall (such an opening for Remote Desktop) can use a brute force attack against your user account for as long as they want without getting noticed at all.   How? The default audit security policy is configured to not log any account logon events, successful or failed.

This allows an attacker to try to hack your accounts for as long as it takes to break in.  There are a few ways to protect against this that I am going to go over in my next article about the Account Lockout policy.  But first, it is important to turn on this account auditing so that you can see who may be trying to break into your accounts.  After you have adjusted the auditing security policy, you will be able to see any account attacks including the account that they tried to logon with and where the request came from.

Let's get started and turn on audition for failed logon events:

  1. Click on the Start Button and key in secpol.msc in the box and hit Enter.
  2. Navigate through Local Policies and Audit Policy.
  3. Right click on Audit account logon events policy and select Properties.
  4. Check the Failure box and hit OK.
  5. Right click on Audit logon events policy and select Properties.
  6. Check the Failure box and hit OK. Your screen should now look like the figure below:
  7. Close Local Security Policy editor.

Your computer has now been configured to log all failed user account logon attempts. 

Once you have turned on account auditing, you can view the logs in Event Viewer (run eventvwr.msc) under Windows Logs and Security. 

Read More