WHAT in the world happened to ip address restrictions PRE-authentication??? In IIS 6, it was as you would expect it - if I deny by IP, drop the connection immediately. Now, in 7.x and above, if you deny by IP, you STILL have the opportunity to auth AND are told whether you were successful or not.
HELLO Microsoft, can you say brute force? Please, does someone know how to make it do IP first, THEN auth? I don't want to hear about adding other junk either - like thresholds and custom scripts and modules.
There has to be a way to make it function like 6 without having to build/add extra stuff. I've tried changing the module orders in the application.config files but that proved to be worthless.
PLEASE HELP!