Question regarding Security event 12294

[Tyson]

Am I correct that this means someone is trying to brute
force the administrator password for our domain? Ths body
seems a little odd; the "unable to lockout the account of
຦ due to a resource error" seems odd with the unprintable
character in there.

We are getting hundreds of these per week btw.

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 4/10/2004
Time: 2:39:00 AM
User: DOMAIN\Administrator
Computer: DC
Description:
The SAM database was unable to lockout the account of ຦
due to a resource error, such as a hard disk write failure
(the specific error code is in the error data) . Accounts
are locked after a certain number of bad passwords are
provided so please consider resetting the password of the
account mentioned above.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: a5 02 00 c0 ¥..À

 

[Steven L Umbach]

Could be. See the link from http://eventid.net for some possibilities. You may want
to look in the security log to see if there are any failed logon attempts and what
computer they are coming from. If none are shown there you may need to enable
auditing of logon events for failure for all computers in the domain looking to see
where these attempts are occurring. You can use Event Comb to scan domain computers
to make the job a lot easier. Event Comb is available in the link below and the white
paper in that link "Account Passwords and Policies" is very good for troubleshooting
account lockouts. --- Steve

http://eventid.net/display.asp?eventid=12294&eventno=875&source=SAM&phase=1
http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Am I correct that this means someone is trying to brute
force the administrator password for our domain? Ths body
seems a little odd; the "unable to lockout the account of
຦ due to a resource error" seems odd with the unprintable
character in there.

We are getting hundreds of these per week btw.

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 4/10/2004
Time: 2:39:00 AM
User: DOMAIN\Administrator
Computer: DC
Description:
The SAM database was unable to lockout the account of ຦
due to a resource error, such as a hard disk write failure
(the specific error code is in the error data) . Accounts
are locked after a certain number of bad passwords are
provided so please consider resetting the password of the
account mentioned above.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: a5 02 00 c0 ¥..À