SAM error with event id 12294

[Scott]

I am receiving the following errors on my Windows 2000
Domain controllers. Any suggestions? Technet,
Support.microsoft.com and eventid.net don't have any
information on this one.

The SAM database was unable to lockout the account of չ
due to a resource error, such as a hard disk write failure
(the specific error code is in the error data) . Accounts
are locked after a certain number of bad passwords are
provided so please consider resetting the password of the
account mentioned above.

Thanks,
-Scott

 

[Alan Sterling [MSFT]]

Hi Scott:

A malicious user may be attempting to logon to the machine by "brute
forceing" the
password.

The SAM event indicates that the enough attempts were made on the
administrator
account to cross the Account lockout threshold. as the administrator cannot
be
locked out, this event is logged instead.

You may also want to look for W32.Randex.F is a network-aware worm that
copies itself as the following files:
\Admin$\system32\NETFD32.EXE
\c$\winnt\system32\NETFD32.EXE


Thanks

 

[Guest]

I have several instances of 1083 in my sys log. Is this a sign of replication problem? As per Q 306091, 1083 is triggered if immediate replication is triggered and collides with local active directory update. So, what this all boils down to? How to fix this warning?

To top it off, I found Event ID 12294 on 11-28-03 and none of our admins were working that day. I will check on the owrm you are talking about in few minutes.