Multiple EventID 4625 Messages

I have 2 Windows web servers (2003 & 2008). They both experience thousands of EventId 4625 on the security log.
They are all against non-existent usernames.
Is there any way to lock them out after a few attempts, as opposed to have them fill up the event log?
They mostly come from IP addresses out of the US.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Tony GiangrecoCommented:
You can capture those hackers using a very good network sniffer from Nirsoft named smartsniff. We used it on a 2003 server and it worked well.

I also suggest adding a good firewall. We also use a Sonicwall TZ210W and also updated the local security policy to lock out any user with three invalid login attempts.

We also installed an app named syspeace on our 2008 server that locks out IP's of known hackers and also locks out IP's that get caught by the Local Security Policy. Their IP get's sent to me and I put a permanent block in the Firewall to lock out their IP. It does not run on 2003 yet.

Smartsniff allows you to track down that IP to a country, and ISP, get its IP range and block out that entire ISP.

Hope this helps!

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
PatAmmiratiAuthor Commented:
Since the user names are invalid, would I still be able to lock them out with a security policy?
Tony GiangrecoCommented:
Probably not, but you can lock the IP span's out if you track them back to their ISP's with smartsniff.
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

David KrollCommented:
I recently began blocking ip addresses in the firewall. I was seeing hundreds of those errors and most of them were outside the US.
Tony GiangrecoCommented:
It;'s much more efficent to block by ISP and/or country than by IP. Hackers normally attach from multiple points.
PatAmmiratiAuthor Commented:
Can IP ranges be blocked within the Server Software, or is additional hardware needed?
Tony GiangrecoCommented:
The Syspeace app can block out ranges, but that means those hits are still getting to your server. I'd block them out on the firewall so your server doesn't get all that static.
Tony GiangrecoCommented:
Have you made any progress?
PatAmmiratiAuthor Commented:
No progress - I have a few ideas, but it seems like a hardware solution is going to be the answer.
I would have liked to know which of the server IP's they were hitting, but I am going to close this problem.
Seth SimmonsSr. Systems AdministratorCommented:
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
Tony GiangrecoCommented:
I object to this question being closed without points being awarded. As I mentioned above, I had the exact same problem on a 2003 terminal server. I worked on that problem for months and found a solution consisting of a SonicWall TZ210W firewall and the installation of an app named SysPeace on the terminal server.  That was then end of consistent hacking attempts on my server.  When I replaced that server with a 2008 server, I installed the same application and kept the same firewall. That combination of proactive steps kept the hackers off my server's doorsteps and out of my network.

Because I developed this combination of proactive steps and the suggested the same solution in this question, I suggest awarding points based on a solid solution I suggested.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.