It seems like SmarterTools isn't willing to implement a possibility in SM 16

 

-  to change brute force settings without restarting the service 

and

- to make a whitelist for the brute force prevention. 

 

I'm wondering why this thread is marked as solved...

 

Anyway, we have the same problem as Brad Underwood. One bigger customers of us (~ 75 Users) faces the fact that his entire business is disrupted, just because one user is entering a wrong password too many times. Like many bigger companys this customer have a dedicated IP address. So it would be no problem to whitelist his IP.

 

For me as a users it's pretty hard to understand, why the existing whitelist for DoS and Email Harvesting cannot be enhanced for the Brute Force protection. I think a enterprise software which is "The ultimate Microsoft Exchange alternative" should considering a scenario where many people are working behind only one IP address. 

When a lot of address / accounts are actively used from the same IP address and someone locks his account only that account should be locked. Not the IP address.
With a kind of reputation system for IP numbers Smartermail would be able to learn if this is realy a attempt to hack from outside or just a user who forgot it's pass.
In the first case, the IP should be blocked according the brute force settings. The IP has 0 reputation, never succesfully logged on.

In the second case, the IP has a good reputation, multiple successful log ons per day, only the user should be locked out.. Warning your account has been disabled, get your cardboard box with the manager ;)

Just for clarification, is the setting needing to be changed the <LoginIsEnabled> parameter under <BruteforceSettings>? This has become a huge issue for one of my clients recently as someone has taken a keen interest in their inboxes.