Event ID 12294

[Ian Marks]

I am runnung Windows 2000 server on SP3.

Recently I have started to get the following error
messages in event viewer.

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 10/08/2004
Time: 10:30:15
User: IRT\administrator
Computer: IRTUKGILDCS0001
Description:
The SAM database was unable to lockout the account of ?
due to a resource error, such as a hard disk write failure
(the specific error code is in the error data) . Accounts
are locked after a certain number of bad passwords are
provided so please consider resetting the password of the
account mentioned above.
Data:
0000: a5 02 00 c0 ¥..À

0000: c00002a5

Event Type: Warning
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1083
Date: 10/08/2004
Time: 12:14:48
User: Everyone
Computer: IRTUKGILDCS0001
Description:
Replication warning: The directory is busy. It couldn't
update object
CN=Administrator,CN=Users,DC=irt,DC=bb,DC=wan with changes
made by directory 89a39c34-f567-4228-abe6-
b351d4cb16c8._msdcs.irt.bb.wan. Will try again later.

I have looked at article number 306091 in the Knowledge
Base but this does not seem to offer any solution.

Can anyone help me?

Cheers

Ian

 

[Guest]

Are you getting alot of these events?
I would start by enabling Auditing of Failed & Successful logon events.

By default the Administrator account in a domain cannot be locked out due to
bad password attempts. This is to prevent being locked out of the entire
domain.

After you enable auditing it should point to the computer(s) where the
failed logon attempts are coming from. Begin looking for problems there.

--
James Brandt [MSFT]


I am runnung Windows 2000 server on SP3.

Recently I have started to get the following error
messages in event viewer.

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 10/08/2004
Time: 10:30:15
User: IRT\administrator
Computer: IRTUKGILDCS0001
Description:
The SAM database was unable to lockout the account of ?
due to a resource error, such as a hard disk write failure
(the specific error code is in the error data) . Accounts
are locked after a certain number of bad passwords are
provided so please consider resetting the password of the
account mentioned above.
Data:
0000: a5 02 00 c0 ¥..À

0000: c00002a5

Event Type: Warning
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1083
Date: 10/08/2004
Time: 12:14:48
User: Everyone
Computer: IRTUKGILDCS0001
Description:
Replication warning: The directory is busy. It couldn't
update object
CN=Administrator,CN=Users,DC=irt,DC=bb,DC=wan with changes
made by directory 89a39c34-f567-4228-abe6-
b351d4cb16c8._msdcs.irt.bb.wan. Will try again later.

I have looked at article number 306091 in the Knowledge
Base but this does not seem to offer any solution.

Can anyone help me?

Cheers

Ian