Solved

Windows 2008 Errors

Posted on 2013-01-22
7
400 Views
Last Modified: 2013-01-22
I have a Windows 2008 domain contoller & it has started throwing numerous event ID 12294:

The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.


This server is also a FSMO role holder & a WSUS server. Has anyone seen this? I rebooted the server & it is still doing this...any ideas?
0
Comment
Question by:wantabe2
7 Comments
 
LVL 11

Expert Comment

by:Venugopal N
Comment Utility
0
 
LVL 15

Author Comment

by:wantabe2
Comment Utility
Doesn't help any...can't disable the admin account.
0
 
LVL 14

Accepted Solution

by:
BlueCompute earned 500 total points
Comment Utility
The error message is misleading - the reason the SAM database was unable to lock out the account is not a resource error, it is because the Administrator account cannot be locked out - you'd be stuffed if it was your last administrator account and it got locked out.

This is usually a sign that the server is subject to a brute-force attack - what services do you have exposed to the internet?  RDP, Exchange, IIS?  You should be able to confirm this by looking in the security log for a large number of authentication failures for the administrator account.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 15

Author Comment

by:wantabe2
Comment Utility
There are no services as such exposed to eh outside world. This is just an internal LAN server that holds the following roles:

WSUS, Domain Controller, DNS server

I've ran a full virus scan & found nothing. There are no authentication failures in the security log. Still getting there same event around 4 or 5 events per minute.
0
 
LVL 15

Author Comment

by:wantabe2
Comment Utility
I've looked in the netlogon.log file to see if there where any clients trying to log on as the administrator but I see no bad password logged....
0
 
LVL 18

Expert Comment

by:sarang_tinguria
Comment Utility
Follow this

Troubleshooting Account Lockout
http://technet.microsoft.com/en-us/library/cc773155(v=ws.10).aspx

Troubleshooting account lockout the PSS way
http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx

Below link is of specific tool which removes the Kido Virus found majorly producing such issues

http://support.kaspersky.com/1956
Go to "Protection measures":->kk.zip

You may check security event logs if auditing is enable to see which machine is generating bad password requests
0
 
LVL 15

Author Closing Comment

by:wantabe2
Comment Utility
I checked the log & discovered which clinet was trying to authenticate to the DC.
0

Featured Post

Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

Join & Write a Comment

Remote Apps is a feature in server 2008 which allows users to run applications off Remote Desktop Servers without having to log into them to run the applications.  The user can either have a desktop shortcut installed or go through the web portal to…
Know what services you can and cannot, should and should not combine on your server.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now