We have an issue where a single user logging in to the web interface triggers the BruteForce policy consequently blocking the entire network.

 

I've found that this is a setting that can be changed in the Web.config.

 

However, what is the difference between ForgotPassword.BruteForce and Login.BruteForce? Will either of these options stop the entire network from being blocked when a single user fails to use the correct password?

 

I may need to propose this idea but I think Smartermail should have some logic built in where a user will get locked out when only a single user failed to login x number of times. But if multiple email accounts from the same location are used and fail to login within x amount of time then the IP address gets blocked. And x number of attempts using invalid email accounts should probably block the IP address as well.