Is the server on an Active Directory domain? If it is, open Users and Computers snap-in. If not on a domain, I think you click Start, click Control Panel, click Performance and Maintenance, click Administrative Tools, and then double-click Local Security Policy. Under there is options for locking out a user account after so many invalid attempts.