how to alert password guessing

From: Wah-Hong Chan (whc@vachi.com)
Date: 08/28/02 

From: "Wah-Hong Chan" <whc@vachi.com>
Date: Wed, 28 Aug 2002 00:30:40 -0400

Hello,

I try to set an alert for server errorlogon counter > limit 10
within 15 minutes interval. But, the counter will not
clear and keep increasing when someone logon failed. And the alert keep
writing to application event log once the limit reached.

What I want to achieve is an alert which will fire when within last 15
minutes, more than 10 failed logon occur. When no more logon failure occurr
in next 15mins, the counter clear and no event pop-up. Any idea?

Thanks,

Hong

Relevant Pages

  • Re: How to audit logons from external IPs?
    ... I think you might want to look at something like the IDS at www.snort.org ... > My idea was to use the Performance Monitor to trigger the Alert, Logon ...
    (microsoft.public.win2000.security)
  • Can I creat an Alert for another end user?
    ... I need to setup an Alert for another End user even though I logon as the ... Administrator. ... Can this be done in sharepoint. ...
    (microsoft.public.sharepoint.windowsservices)
  • Setting account lockout alert
    ... sent to the administrator when a users account is either ... errors access permissions and errors logon counters set. ... I just basically would like an alert sent if someone tries ...
    (microsoft.public.win2000.security)
  • Re: When I assign an Issue to someone no email is generated
    ... have them logon and click the alert me in the issues section and configure ... > I am running on WSS 2.0 ... Prev by Date: ...
    (microsoft.public.sharepoint.windowsservices)
  • RE: logon attempt inetinfo.exe
    ... I understand that you want SBS send alert ... SBS can monitor event log and send alert email to ... Partnerfeedback newsgroup to make Microsoft products easier and more ...
    (microsoft.public.windows.server.sbs)