I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get prompt for credentials. Suppose they know a username, can they try several attempts to lock out the account? There is not special monitoring or protection, it's a simple IIS reverse proxy.

2 Answers 2


Yes, if the user authenticates against a domain controller, then bad password attempts will lock out the account in accordance with the security policy that applies to the account. (The domain controller doesn't care where the authentication attempt comes from.)


So what you have here is actually a risk. By exposing your internal Windows authentication to a public website it is now possible to automate brute force attacks against accounts if names are known or guessable.

The lock out will stop this of course but now you have a case of a DoS against user and service accounts that can affect your internal network.

You need an additional control or account policy here unless you want to wear this as a risk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .