help required

[KK]

Hi,
i have been getting this error message from several days on one of my domain
controllers,as far as i know.. we have not changed the administrator
password.
IN system Event

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 11/26/2003
Time: 8:13:39 AM
User: FICWORKGROUP\Administrator
Computer: WADDC02
Description:
The SAM database was unable to lockout the account of ? due to a resource
error, such as a hard disk write failure (the specific error code is in the
error data) . Accounts are locked after a certain number of bad passwords
are provided so please consider resetting the password of the account
mentioned above.
Data:
0000: c00002a5

and in Directory Services log

Event Type: Warning
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1083
Date: 11/26/2003
Time: 9:51:31 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: WADDC02
Description:
Replication warning: The directory is busy. It couldn't update object
CN=Administrator,CN=Users,DC=corp,DC=register,DC=com with changes made by
directory cc5f0d3c-b34e-4d55-a516-88a3c817c227._msdcs.corp.register.com.
Will try again later.


I checked with repadmin utility,it is showing no issues.
I checked with lockoutstatus utility, which is also showing no issue with
admin account.
ADUC is also showing the account to be not locked out.

What should I check ?
Thanks
GK

 

[Tim Hines [MSFT]]

Check for viruses on the sysytem. These errors are usually caused by
viruses that issue brute force attacks against accounts. I've included
links to one below. There are a few variants of this.

http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.f.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.b.html


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[KK]

Hi Tim,
thanks for the tip,but on the same hand i have been updating the antivrus
def't on these puppies more often then any other servers.I do manual scans
of most of the threats and warning's...like look for a file or specific
virus behaviour in these servers..but nothing.

ANything else you could suggest.
Thanks
GK