I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get prompt for credentials. Suppose they know a username, can they try several attempts to lock out the account? There is not special monitoring or protection, it's a simple IIS reverse proxy.
So what you have here is actually a risk. By exposing your internal Windows authentication to a public website it is now possible to automate brute force attacks against accounts if names are known or guessable.
The lock out will stop this of course but now you have a case of a DoS against user and service accounts that can affect your internal network.
You need an additional control or account policy here unless you want to wear this as a risk.