text: Q:
  
  Win2008R2 :Brute force attack prevention
  
  I am using Windows 2008 R2.
  I am wondering if there is any way to block a brute force attack.
  I seeked here and there and I could not find a way to block an IP address after its makes some failing attempts to logon.
  Maybe I missed something obvious.
  There should be something that monitor event log for logon failure events and block culprit IP address
  
  A:
  
  In the group policy editor,
  
  Computer configuration \ Windows Settings \ Security settings \ Account policies \ Account lockout policy
  
  Voted to migrate to SF.
  
  A:
  
  If you want to block the ip you can use firewall policies to block the ip.  Windows will lock an account and auto unlock it at times specified in the account security policies.  This typically prevents brute force attacks, when set at reasonable times, but on an unmonitored server, could lead to a DOS attack.  A simple solution is to write a script to parse the logs for account lockouts and after N number of lockouts block the ip.  This script can run scheduled at whatever interval makes sense for your situation.  An IDS will also solve the issue.
  
  