No announcement yet.

Event ID 12294 errors

  • Filter
  • Time
  • Show
Clear All
new posts

  • Event ID 12294 errors

    Hi all,

    I am getting the following error on my Windows 2008 SP2 domain controller.

    Event Type: Error
    Event Source: SAM
    Event Category: None
    Event ID: 12294
    Date: 10/08/2004
    Time: 10:30:15
    User: xxxxxxxxxx
    Computer: xxxxxxx
    The SAM database was unable to lockout the account of ?
    due to a resource error, such as a hard disk write failure
    (the specific error code is in the error data) . Accounts
    are locked after a certain number of bad passwords are
    provided so please consider resetting the password of the
    account mentioned above.
    0000: a5 02 00 c0 ..
    0000: c00002a5

    I have done various googgling and I know people will tell me its a replication error.
    However we have one domain controller, 20 users and so its a very small setup.

    I haven't been able to do integrity checks, but these errrors have only appeared since changing the domain admin password. We only have 3 servers and I have checked the log on details of all services, tasks, shares across the lot and nothing.

    The domain admin password is getting locked out as it states in AD but as we know it doesn't get fully locked.

    Any help or additional checks would be great. I have seen some fixes of changing the name of the domain admin but that seems a bit of a hack.

    Thanks in advance

  • #2
    Re: Event ID 12294 errors

    Domain admin account should not be lockable so I suggest you check for a cached old DA password somewhere
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    IT Trainer / Consultant
    Ossian Ltd

    ** Remember to give credit where credit is due and leave reputation points where appropriate **


    • #3
      Re: Event ID 12294 errors

      I know it's not lockable, in AD if I go to the admin acct it will state it's locked but still allow me to log in. It's a msoft failsafe.

      And I know you are trying to help but I have combed the 3 servers we have for anything using the DA. We are a very simple setup but I joined on Monday and the previous IT engineer left before I joined.


      • #4
        Re: Event ID 12294 errors

        is RDP publically accessible?
        Please do show your appreciation to those who assist you by leaving Rep Point


        • #5
          Re: Event ID 12294 errors

          Sorry how do you mean ?


          • #6
            Re: Event ID 12294 errors

            like.. has someone published port 3389 to the internet on your firewall.. ?

            3389 is a great one for brute force. someone may be brute-forcing your admin pwd
            Please do show your appreciation to those who assist you by leaving Rep Point


            • #7
              Re: Event ID 12294 errors

              ahh no it's not

              Plus I have used the lockout tool and noticed its 4 laptops that are locking the account. All IBM x220i's running win7 pro 64 bit, I have checked all tasks and services and cannot find anything.

              I wondered if its a authentication issue, however I have other Win 7 pro 64 bit clients.