Invalid login attempts alert

[Dedatorv]

Hi, I've been googling this like crazy trying to find some sort of keyword that will get me the results I want. I am looking for some piece of software that can alert me when I sign in to my computer about previous invalid password attempts.

For example, I log off my computer and leave, someone attempts to guess my password and fails, I come back and log in and I get a message box informing me that someone attempted to log in at so and so time.

Any kind of software like that?

 

[Dedatorv]

No one else has ever heard of a program to do something like this?

 

[DrNic2032]

Which OS are you using?

There was a program for XP that would log the times that attempts were made to login. Unfortunately it stopped working at SP2 and the developer dropped the product.

You can maybe try something like the following but I'm not sure if it works with Vista.
http://my.brandeis.edu/bboard/q-and-a-fetch-msg?msg_id=0000Ya

 

[drdeutsch]

Wouldn't there be a notification of some kind in the Event Viewer?

Or would it be possible to add a policy to audit local login attempts?

 

[Dedatorv]

Thanks for the responses, this seems to be what I was looking for. I've never done this kind of networking/administrative stuff before. I have Vista and I was able to follow the steps in it except I do not know how to exactly save the settings. The instructions dont mention how to save the changes. If I were to actually get this working, would I get some sort of notification or would I have to pull up a logging program?

 

[Demon10000]

Is this what you're referring to:

1. Log on as an administrator
2. Click Start, click Run, type mmc /a (note the space between mmc and /a), and then click OK.
3. On the File menu, click Add/Remove Snap-in, and then click Add.
4. Under Snap-in, click Group Policy, and then click Add.
5. In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
6. At this point, you might want to save this console for further use. Note you can add multiple snap-in and manage multiple computers from this console. I find it rather useful myself.
7. On the left hand side, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
8. On the right hand side, double-click "Audit Logon Events"
9. Check the boxes for Success and Failure, click OK
10. You can close the Microsoft Management Console, though you might want to snoop through the other possible settings first.

When you make changes tot he policy, they are active as soon as the policy refreshes. Some policies refresh almost immediately, other when you restart the computer. Odds are, it's already taken effect for you.

You will have to pull the results from the event log. You could write a script to do it, then present you the results when you log on...