OWA auditing

Ted · Joined: 05 Aug 2007 Posts: 2

On the domain where I work users are set up where they get
3 tries to log on the network and then are locked out of
the network if all 3 are incorrect. I'm sure you are all
familiar with this concept.

Well, we also use OWA in our Intranet. Users have to
authenticate to it seperately but it is using their NT
username and password. I have found that you can attempt
to connect more than 3 times and never get locked out.
This seems to be a security hole. From this it seems a
dictionary attact could be easily made.

My question is this:
Is there a way to track failed logon attempts from OWA?
Also, can it be set up to lock an account after x failed
attempts?

Archived from group: microsoft>public>exchange>applications

Ted · Joined: 05 Aug 2007 Posts: 2

Thanks for your reply. This seems like a big hole to me.
How many admins bother tracking their IIS logfiles? I
guess it is 1 more thing we need to be on the lookout for.

t

>
>I don't think you can lock the accounts out, but you can
do some work with
>the IIS logiles to track the failed logons.
>
>All you need to look for are repeated 401 statuses that
are _not_ followed
>by a 200 status.
>
>Lee.
>
>
>--
>___________________________________
>
>Outlook Web Access for PDA and WAP:
>www.leederbyshire.com
>email a t leederbyshire d 0 t c 0 m
>___________________________________
>
>
>
>.
>

Lee Derbyshire · Joined: 05 Aug 2007 Posts: 10

"Ted" wrote in message$ddfe29d0$a601280a@phx.gbl...
> On the domain where I work users are set up where they get
> 3 tries to log on the network and then are locked out of
> the network if all 3 are incorrect. I'm sure you are all
> familiar with this concept.
>
> Well, we also use OWA in our Intranet. Users have to
> authenticate to it seperately but it is using their NT
> username and password. I have found that you can attempt
> to connect more than 3 times and never get locked out.
> This seems to be a security hole. From this it seems a
> dictionary attact could be easily made.
>
> My question is this:
> Is there a way to track failed logon attempts from OWA?
> Also, can it be set up to lock an account after x failed
> attempts?

I don't think you can lock the accounts out, but you can do some work with
the IIS logiles to track the failed logons.

All you need to look for are repeated 401 statuses that are _not_ followed
by a 200 status.

Lee.

--
___________________________________

Outlook Web Access for PDA and WAP:
www.leederbyshire.com
email a t leederbyshire d 0 t c 0 m
___________________________________