Hello vico1:
Thanks for the good advice. I had the conflicker worm virus and spent the night cleaning the network. All is back to normal--for now. I am concerned it may surface again. I will award you the points.
Main Topics
Browse All TopicsHello Experts:
My administrator account in active directory is being continouesly lock out after I unlock it and also it there are random users that are locked out with the same symptom. My System Event log shows the follow:
Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 7/22/2009
Time: 9:00:55 AM
User: TITANCO\administrator
Computer: COMMSERVER
Description:
The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.
For more information, see Help and Support Center at http://go.microsoft.com/fw
Data:
0000: a5 02 00 c0 ¥..À
Does anyone know how to fix this issue?
Thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Great!
In the mean time the following are Tools and Links that will Help you. They were gathered from EE and other sites.
*****Exchange*****
How to block open SMTP relaying and clean up Exchange Server SMTP queues in Windows Small Business Server
http://technet.microsoft.c
*****Terminal Service Security******
http://www.msterminalservi
TO find out what ports are open/exposed do the following
Start >Run >type "cmd" {enter}
At the command line type "netstat -a" {enter}
The list displayed shows "Listening ports" and established "Who is on the other end" connections to yout computer.
WARNING
This is a list of common Trojan/Backdoor Port numbers
http://www.sans.org
W
Save who is listening to a text file: netstat -an |find /i "listening" > c:\openports.txt
Who is established? Use this syntax: netstat -an |find /i "established"
Note: In Windows XP, you can type NETSTAT -O to get a list of all the owning process ID associated with each connection: netstat -ao |find /i "listening"
*****Pulist****
You can use PULIST from the W2K Resource Kit to find the PID and see what process uses it and who started it. For example, you found out that your computer had an open connection to a remote IP address on TCP port 80, and you don't have any Internet Explorer or other browser windows open. You want to find out what process is using that session.
Download: http://www.microsoft.com/w
*****L
P
http://www.microso
TCP/UDP Ports Used By Exchange 2000 Server
http://support.micro
Nice shiny Port List :0)
http://hackerwhacker.co
http
http://
*
Scan Yourself (Free)
Scan your Ports with Port Detective: lets you scan your PC ports to see which are open, in use, or blocked. This will help you find out how vulnerable your system is to hackers, and will also let you know which ports you can use for applications such as Web servers
http://www.portdete
Scan Remote COmputers (Free)
Advanced port scanner is a small, fast, robust and easy-to use port scanner for Win32 platform. It uses a multithread technique, so on fast machines you can scan ports very fast. Also, it contains descriptions for common ports, and can perform scans on predefined port ranges. You can use it for FREE. Download now!
http://www.antivirus.c
Good luck!
Vico1
Business Accounts
Answer for Membership
by: vico1Posted on 2009-07-23 at 07:27:51ID: 24925562
It is always bad practice to use Administrator as a real username on a server as most expert recommend this as the first step to secure your server.
I think you should look further to find out if there is in fact a large number of failing attempt to access the server using account "TITANCO\administrator"
It sounds more like
1. somebody is trying to gain access to your server
2. Some services are still using an old password therefore are denied access.
Either way the reason why you have this error is because Someone or something is trying to access your server. You fix that then you will fix your problem.
Vico1