Re: Event ID 12294 - The SAM database was unable to lockout the account...

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 08/10/04 

Date: Tue, 10 Aug 2004 19:02:17 GMT

Hi Blake.

Have you seen the KB below that mentions AD collisions as a possibility? I have not
seen it myself, so can not offer much more as far as a solution but I thought you
might be interested in the KB. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;306091

"Blake" <blake_duffey@NOSPAM.hotmail.com> wrote in message
news:O2foZfwfEHA.3544@TK2MSFTNGP10.phx.gbl...
> I can understand the inclination that this is a password guess attempt, but
> the frequency of these logs makes that unlikely.
>
> I am just worried that this is a problem with the AD itself. It could be a
> service trying to log on...
>
> <jabrandt@online.microsoft.com> wrote in message
> news:eUqcNLlfEHA.596@TK2MSFTNGP11.phx.gbl...
> > Blake, I would consider the fact that it could be someone attempting to
> > guess a user account password. Since it is only a couple of times a day
> > that would not be my first guess. If you dont already, enable auditing on
> > logon events success and failures. This might help provide further info
> > in the security event log about which DC is attempting the authentication
> > and the user account.
> > My inital reaction would be that you have a user account that the password
> > has been changed on and you still have either a service or TS session that
> > is attempting to authenticate with the old password.
> >
> >
> >
> > --
> > James Brandt [MSFT]
> >
> >
> > "Blake" <blake_duffey@NOSPAM.hotmail.com> wrote in message
> > news:%23EVeQj%23eEHA.1724@TK2MSFTNGP10.phx.gbl...
> >> Getting this a couple times/day in the event log of our DCs (Windows 2000
> >> native mode AD):
> >>
> >> The SAM database was unable to lockout the account of ? due to a resource
> >> error, such as a hard disk write failure (the specific error code is in
> >> the error data) . Accounts are locked after a certain number of bad
> >> passwords are provided so please consider resetting the password of the
> >> account mentioned above.
> >>
> >> Anybody seen this before??
> >>
> >> Blake
> >>
> >
> >
>
>

Relevant Pages