Turn on auditing to monitor account attacks
There is no doubt that all of the security features in Windows Vista will help keep your computer secure. However, these features become less valuable when they are not turned on by default. One feature, known as user account auditing, is not turned on by default. With this feature is turned off, anyone with physical access or remote access to through a hole in your firewall (such an opening for Remote Desktop) can use a brute force attack against your user account for as long as they want without getting noticed at all. How? The default audit security policy is configured to not log any account logon events, successful or failed.
This allows an attacker to try to hack your accounts for as long as it takes to break in. There are a few ways to protect against this that I am going to go over in my next article about the Account Lockout policy. But first, it is important to turn on this account auditing so that you can see who may be trying to break into your accounts. After you have adjusted the auditing security policy, you will be able to see any account attacks including the account that they tried to logon with and where the request came from. Read More»
