title: How can I throttle failed logins in SQL Server 2005?
body: <p>I believe my server has been the ongoing target of a brute-force attack on SQL Server 2005 (SQLExpress). My Event Viewer log is filled with "Failure Audit" messages for SQL Server. The attempts usually last for an hour or two, with 1-2 seconds between attempts.</p>
  
  <blockquote>
    <p>Login failed for user 'sa' [CLIENT: 222.169.224.163]</p>
  </blockquote>
  
  <p>Event ID: 18456. Based on matching entries in the SQL Server log, I have found that each login fails due to a mismatched password. I have also seen attempts for other users, including 'administrator' and 'administrador'. Each session comes from a different IP address, and are from countries like Italy and China.</p>
  
  <p><strong>What countermeasures can be taken?</strong> I do not want to lock out the user account, because then my site and applications will not have access to the server. Is there a way to throttle login attempts through SQL Server 2005? E.g. geometrically increase the 'wait period' between failed login attempts?</p>