I am using SQl Server 2005 Express and my client uses SQL Server 2005.  We both are getting users who are attempting to log into our servers in the wee hours of the morning using either user names of "root" or "sa".  I would like to know is there a way in SQL server itself that after like two failed logins it blocks that IP address entirely from attempting to log onto the SQL server?  Any suggestions would be great.  We are considering a firewall, but I want to see if there's another option that we might be overlooking without implementing a firewall and it may not still solve the problem.

 There are 2 ways to stop this.  First change the port sql server uses from 1433 (the default) this will make it much more difficult to connect to the server.

 http://searchsqlserver.techtarget.com/tip/0,289483,sid87_gci1219962,00.html

The other option is to block the ip address with the local security policy.  Be very carefull doing this