From e24536ce0eec7b737ada95318325dd752cb6f19e Mon Sep 17 00:00:00 2001 From: FrenzyTheory Date: Fri, 13 Sep 2013 17:00:12 -0700 Subject: [PATCH] Create TaskScheduler_Import.xml change path to ts_block.vbs when you import this into task scheduler, this will will launch ts_block.vbs everytime a login attempt happens. no need to run as service. --- TaskScheduler_Import.xml | 49 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 TaskScheduler_Import.xml diff --git a/TaskScheduler_Import.xml b/TaskScheduler_Import.xml new file mode 100644 index 0000000..b8f7c00 --- /dev/null +++ b/TaskScheduler_Import.xml @@ -0,0 +1,49 @@ + + + + 2013-09-13T07:55:17.5416169 + FRENZYTHEORY\Administrator + TS_BLOCK stop bruteforce login attempts + + + + + PT5M + false + + true + <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Security'] and EventID=4625]]</Select></Query></QueryList> + + + + + FRENZYTHEORY\Administrator + S4U + LeastPrivilege + + + + IgnoreNew + true + true + true + false + false + + true + false + + true + true + false + false + false + PT0S + 7 + + + + C:\Users\Administrator\ts_block.vbs + + +