Failed Login Attempts

Every login attempt, successful or not, writes an Activity Log row. This card counts the rows whose status is Failed, with no date filter, so it is a running total of wrong passwords since the system went live. A handful is normal; a sudden jump of dozens in a day suggests someone is guessing passwords, especially on the Administrator account. Nothing here touches the books, but the IRD's Electronic Billing Procedure expects an activity log, and this is part of it.

Failed Login Attempts = Count of Activity Log where operation = Login and status = Failed

1. 01Go to Users and read the card.
2. 02Click the card to open the Activity Log list filtered to failed logins, sorted newest first.
3. 03Open a row to see the user name and IP address of the attempt.
4. 04To limit it to a period, open the card menu > Edit and add a Timespan filter.
5. 05If attempts cluster on one user, reset that password and enable two factor login.

A sudden rise can mean someone is guessing passwords.

A few mistyped passwords by staff show as a small number.