Re: Event 12294 SAM error

Tech-Archive recommends: Fix windows errors by optimizing your registry

Did the users actually try to login with the wrong password and generated
this event? You also mentioned that the system was checked with Symantec
Antivirus, using the latest virus patterns. Please note that in itself, that
doesn't mean there is no virus - maybe the av did not detected. From my
experience, even with the latest updates, sometimes an antivirus may fail to
detect a virus. Try to run Process Explorer (from www.sysinternals.com) and
see if there is any strange process running on that machine.

--
Adrian Grigorof
www.eventid.net


"Speaker Ender" <SpeakerEnder@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B340BD1C-862D-4C23-97AD-9D941B6A8FD5@xxxxxxxxxxxxxxxx
Yeah the error code was not much help.

It is different usernames, and it took a while to track down that it was
coming from the webserver and not a specific workstation.

There is nothing else that appears related in any of the logs. No errors
in
the File Replication Service log, nothing in Directory Services or any of
the
other logs.

Looking in the log and analyzing it with NLParse and there are no accounts
with current password is not correct.

I checked the link, I've seen it before, and finally hunted down his part
III, the problem seems to be different though, as none of the services on
the
webserver use regular user accounts. I'm almost thinking it is something
with IIS and how its authenticating the users (i.e. when it fails the
third
time it should tell the DCs to lock the account, but doesn't).

"Adrian Grigorof" wrote:

Well, the error code means "DS (Directory Services) is busy" - not much
help
there. How about the user name - is it the same all the time? Is the
webserver a domain controller? Any other relevant events in the log?
Also,
take a look at this page:
http://www.eksternkompetanse.no/blog/PermaLink,guid,576846a0-ac14-47d4-8057-c117a9e2ec1c.aspx

--
Adrian Grigorof
www.eventid.net




.

Relevant Pages

  • Re: Number of e-mail Acccount Limitations???
    ... accounts that I check. ... Disable e-mail scanning in your antivirus program. ... E-mail scanning is superfluous for viral detection. ... can cause timeouts by either the e-mail client or the mail server. ...
    (microsoft.public.outlook)
  • Re: "The server you are connected to is using a security certifica
    ... >> That particular error message has nothing to do with antivirus>> problems. ... >> that contains the server name, ... >> Tools, Accounts, select that account, Properties, Advanced. ... >>>> Windows Defender and its updates are 100% compatible with Windows ...
    (microsoft.public.windows.vista.mail)
  • Re: change administrator question
    ... antivirus program when they surf the net. ... Also set the Supervisor password in the BIOS so BIOS ... Make other users Limited accounts in XP Home, ... you can set user permissions/restrictions with ...
    (microsoft.public.windowsxp.general)
  • Re: problems with muti-identities in OE
    ... We do have antivirus running. ... Accounts 2,3, and 4 show the same thing in the ... If you have antivirus software scanning email, ... Because of this tendency of attachments to infect, ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)