Re: Event ID 12294

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

jabrandt_at_online.microsoft.com
Date: 08/10/04 

Date: Tue, 10 Aug 2004 15:51:14 -0500

Are you getting alot of these events?
I would start by enabling Auditing of Failed & Successful logon events.

By default the Administrator account in a domain cannot be locked out due to
bad password attempts. This is to prevent being locked out of the entire
domain.

After you enable auditing it should point to the computer(s) where the
failed logon attempts are coming from. Begin looking for problems there. 

-- 
James Brandt [MSFT]
"Ian Marks" <anonymous@discussions.microsoft.com> wrote in message 
news:320401c47ecd$d9537fa0$a301280a@phx.gbl...
I am runnung Windows 2000 server on SP3.
Recently I have started to get the following error
messages in event viewer.
Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 10/08/2004
Time: 10:30:15
User: IRT\administrator
Computer: IRTUKGILDCS0001
Description:
The SAM database was unable to lockout the account of ?
due to a resource error, such as a hard disk write failure
(the specific error code is in the error data) . Accounts
are locked after a certain number of bad passwords are
provided so please consider resetting the password of the
account mentioned above.
Data:
0000: a5 02 00 c0               ¥..À
0000: c00002a5
Event Type: Warning
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1083
Date: 10/08/2004
Time: 12:14:48
User: Everyone
Computer: IRTUKGILDCS0001
Description:
Replication warning: The directory is busy. It couldn't
update object
CN=Administrator,CN=Users,DC=irt,DC=bb,DC=wan with changes
made by directory 89a39c34-f567-4228-abe6-
b351d4cb16c8._msdcs.irt.bb.wan. Will try again later.
I have looked at article number 306091 in the Knowledge
Base but this does not seem to offer any solution.
Can anyone help me?
Cheers
Ian

Relevant Pages

  • RE: DCpromo issue. Health check on AD and group policy.
    ... Enterprise Admins group, or at the least a domain admin account of the domain ... Try running MS Sonar to check you SYSVOL replication status: ... Use sonar to check if the sysvols (File Replication Service) is replicating. ...
    (microsoft.public.windows.server.active_directory)
  • RE: All users denied access this morning ......
    ... Please let me know whether all of users cannot login domain, ... the message appears to be the result of normal replication ... display the actual account name and instead showed question marks where the ... PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were ...
    (microsoft.public.windows.server.sbs)
  • Re: Cluster Resource replacing physical server
    ... regardless of the status of the AD replication. ... Create the virtual computer account manually if the Cluster service account ... Then connect to cluster administrator to Enable Kerberos on the network name ... Create cluster resource ...
    (microsoft.public.sqlserver.clustering)
  • Re: 2003 Server Client/Delegation and Data Issues
    ... Thank you Jorge. ... caused by the fact the replication didn't occured yet, ... I want to delegate the ability to unlock user accounts to 3 non-technical ... it shows an account as locked ...
    (microsoft.public.windows.server.active_directory)
  • Re: Subscriber Security Settings for Distributor and Publisher log
    ... Looking for a book on SQL Server replication? ... >> It is done through SQL Server authentication or NT Authentication. ... > using Authentication it authenticates using the account that your SQL ...
    (microsoft.public.sqlserver.replication)