Event ID:12294

[emilylsm]

Hi, I have this Event ID:12294 log every 1 minute in the system event viewer.

The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.

Any idea why this event is logged? It only happened last week.

All the servers and clients are with latest service pack and no viruses was found.

[Tripredacus]

Well to start, it would appear that someone forgot the Administrator password or someone was trying to guess it. Windows had attempted to lock out the Administrator account because the total number of logon failures determined by your Group Policy settings had been exceeded. This was likely to have been done via an outside method. It may be possible that AD was denied locking out the Administrator account if it was actively being used to run specific services. So that being said, here are some questions...

1. Is this referring to the domain or local computer Administrator account?

2. Have you recently changed the password for either account?

3. Does any of the clients, or server applications use a static method of connecting to the server, by way of a script or program or any remembered password methods?

4. If 3 is correct, are any of those methods set up to automatically connect to the account every x amount of seconds, for example if you have an email client that connects to your mail server to access the Administrator email account but the password was changed or the client is configured wrong.

5. Does your network have the ability to be connected to by outside your domain, such as a VPN?

6. Try to map a network drive from a client to the server using the Administrator account to see if it works or gives you an error.

And lastly, please post the "Data" that the event is referring to, which is located in the textbox (the hex info) below the Description field.