Invalid Login Attempts report
About
NextStep records every failed attempt to enter a user name and password. This includes the main sign-in page, the prompt that appears after a session times out, and the password prompts used to sign forms and notes. The Invalid Login Attempts report shows each failed attempt, including the name that was typed and where the attempt was made.
Use it to find out whether someone is repeatedly typing a wrong password, or whether anyone is trying to sign in with a name that does not belong to your agency.
Find the Report
- From the Main Menu, under Reports, select Administrative Reports.
- Scroll down to the Administration section at the bottom of the page.
- Select Invalid Login Attempts.
Note: Reports appear based on user permissions. If you do not see this report, ask your NextStep system administrator to review your access. For more information, see User Permissions.
Run the Report
- Open Invalid Login Attempts.
- In the Preview Parameters panel, enter a Start Date and an End Date. When the report opens, the dates are set to the last 30 days.
- Select Submit.
Note: This report includes the entire End Date. To see a single day, enter the same date in both boxes.
Read the Results
Each row is one failed attempt, listed in the order it happened.
| Column | What it shows |
|---|---|
| Attempted Login Name | The user name exactly as it was typed, even if no such user exists. |
| IP Address | The network address of the computer that made the attempt. |
| Date and Time | When the attempt happened, in your time zone. |
| Which Page | Where the attempt was made. Main Login is the sign-in page. Session Timeout is the prompt shown after a session times out. Other values, such as Sign Multiple Notes or Revoke Form, are password prompts shown when a user signs a form or note. |
In this example, five failed attempts were recorded between 11/4/2026 and 11/11/2026, all on the Main Login page. They used slightly different spellings of the same name. Three of them happened within 30 seconds of each other on 11/6/2026.
What to Look For
- Several attempts in a row for one user. This is often a forgotten or mistyped password. Confirm with the user and reset the password if needed.
- User names that are not on your staff list. An unknown name may mean someone is guessing at sign-in names.
- An address you do not recognize. Compare the IP Address to the addresses your agency normally uses.
- Repeated attempts for a real user name. The account may be locked after too many failed attempts. Check the user's account in Maintain Users.
Export the Results
Select the Export icon in the toolbar above the report and choose a format. You can export to PDF, XLS, XLSX, RTF, DOCX, MHT, HTML, Text, CSV, or Image.
Related Reports
To see which pages each user opened, see View the Access Log Report.