• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5131
  • Last Modified:

Microsoft-Windows-Directory-Services-SAM-Event ID: 12294-

have a windows 2008 sbs-2007 exchange server... that started getting the following error:
Microsoft-Windows-Directory-Services-SAM-Event ID:      12294
had vpn added/enabled to the existing sonicwall and all was good for a day, don't know if it is  related, if i unplug the ISP then the sam error seems to go away...Virus? HELP...hope zones are selected correctly for help...

here is whole error;
Log Name:      System
Source:        Microsoft-Windows-Directory-Services-SAM
Date:          10/20/2011 8:36:48 AM
Event ID:      12294
Task Category: None
Level:         Error
Keywords:      Classic
User:          BOXERNW0\administrator
Computer:      PDXSBS.boxernw.int
Description:
The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Directory-Services-SAM" Guid="{0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE}" EventSourceName="SAM" />
    <EventID Qualifiers="0">12294</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-10-20T15:36:48.000Z" />
    <EventRecordID>748101</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>PDXSBS.boxernw.int</Computer>
    <Security UserID="S-1-5-21-1409082233-1343024091-839522115-500" />
  </System>
  <EventData Name="SAMMSG_LOCKOUT_NOT_UPDATED">
    <Data Name="UserName">Administrator</Data>
    <Binary>A50200C0</Binary>
  </EventData>
</Event>
0
gstevederby
Asked:
gstevederby
  • 4
2 Solutions
 
npinfotechCommented:
One of these solutions might help:

http://www.eventid.net/display.asp?eventid=12294&eventno=875&source=SAM&phase=1

From a Usenet post: "Think I have sorted this problem, one of our servers has a different Local Administrator password, compared to Domain Administrator, because all services on that server use the local Admin account. I don't know what services require the domain wide account, but setting them the same has fixed all problems."

The most common error code found in the data portion of the event is a5 02 00 c0 (that is hex error 0xc00002a5 - DS_BUSY).
0
 
gstevederbyAuthor Commented:
the netlogon.log is empty...but looking at some of the other options thx. Any other ideas would be helpfull as to try to determine if ANY clients are the prob. checked with antivirus but none found, they have like about 30 users, and 3 other servers...what if the vpn had a diff. administrator password or is that how it works, can't seem to get anyone to tell me EXACTLY how vpn logs in...thx
0
 
gstevederbyAuthor Commented:
still not finding any answers, but now it comes and goes..might last for 8 hrs. then not be there for 24 then back for 12 or 24 then gone again...very perplexing.. All Server have the same administrator password...so ???
0
 
gstevederbyAuthor Commented:
DID NOT FIX MY PROB.
0
 
gstevederbyAuthor Commented:
DID NOT FIX MY PROB.
0

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now