I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files.

I know what the cause is (another misconfigured server), however I was wondering what impact those requests would have on the server?

Would it affect performance in anyway, or is it just a minor annoyance when I am reading logs?

Obviously it is going to be fixed, but I don't know how urgent I need to make it sound. Not sure if I should be treating it as a minor DoS-type issue or just sticking it on someones todo list.

(Assuming a high-speed network, 4 CPU, 8GB RAM)


1 Answer 1


An inbound network logon within Windows will generally have negligible measurable effects on a machine and a failed logon attempt will have even less. However, it is a non-zero cost and whether it will impact your workload is entirely dependent on the resources consumed vs available.

You have to measure what sort of overhead your server has normally. If it's constantly running hot at >95% CPU, or is constantly running out of disk space it might put you over through e.g. event log growth (if it's not constrained to a fixed upper limit).

  • Thanks, this is exactly what I needed. Not sure why I got a downvote, my entire team had the same question and google wasn't being helpful.
    – Hawke
    Jun 11, 2019 at 12:44
  • It's unclear why someone downvoted. It's a good question.
    – Steve
    Jun 11, 2019 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .