Kidem said:
Did you google the exact error message you're getting, surrounded by
"quotes"? And what exactly are you trying to do?
Ohh im googled it!! I thought when there is a bad password attempt doesnt
it log it in that log file?? i have more extensive logging for the
netlogon.log file here is what im getting in it, this happens at same time
i get the events in event viewer 12294!
"[CRITICAL] NlPrintRpcDebug: Couldn't get EEInfo for
I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006a)"
I have no idea what that file is, I've never used it. It's not where I look
for password and SAM log events, I look in the Windows Security Event Log in
the My Computer Management console. Interestingly, Google reports zero hits
when you search microsoft.com for passwd.log, which makes me think it's an
undocumented feature Microsoft didn't intend users to be using. One site I
found in google suggests this is the "Log file for the
SamChangePasswordUser2 API (used by the Change Password dialog box available
after the Control-Alt-Delete sequence)" In which case, not all SAM errors
would be logged there, only ones involving password changes after pressing
CTRL-ALT-DEL.
I'm not sure if you're having a problem or not. Is there any other text in
those SAM errors? Are you experiencing any symptoms or problems? Google
suggests this:
"The SAM database was unable to lockout the account of ? due to a resource
error, such as a hard disk write failure (the specific error code is in the
error data) . Accounts are locked after a certain number of bad passwords
are provided so please consider resetting the password of the account
mentioned above."
It could also be someone trying to guess your passwords remotely. Do you
have a firewall protecting these systems from connections from the Internet?
See here for more info:
http://www.pcreview.co.uk/forums/thread-1458120.php
http://www.google.com/search?q=SAM+database+error+12294