Event ID 12294

[Eoin O'Beara]

Hi all,
Started getting this error at about 8:30 this morning on a server. It is
one of four DCs (two in each site) in the same domain. No passwords have
been changed, no applications running that need a password. If users logout
they are locked out. Any ideas? I have found some information about this,
but never any fixes (very frustrating!). All servers are Win2k Standard
server with SP4 and Symantec AV.

Many thanks,

Eoin.


Event ID: 12294
Source SAM
Type Information
Description The SAM database was unable to lockout the account of due
to a resource error, such as a hard disk write failure (the specific error
code is in the error data). Accounts are locked after a certain number of
bad passwords are provided so please consider resetting the password of the
account mentioned above.
Data: 0000: c00002a5

 

[Tom Ausburne]

All the references I saw from previous cases point to either a virus
or a malicious hack attempt. I would enable Netlogon logging and see
if you see any patterns.

109626 Enabling Debug Logging for the Net Logon Service
http://support.microsoft.com/?id=109626


Tom Ausburne (MSFT)
Windows 2000 Directory Services
This posting is provided "AS IS" with no warranties, and confers no
rights.