Problems with error 12294 SAM error (unique?????)

[celdridge]

Hi,

i am having real extream drama's here with event ID 12294.

the data is

The SAM database was unable to lockout the account of ? due to a resource
error, such as a hard disk write failure (the specific error code is in the
error data) . Accounts are locked after a certain number of bad passwords
are provided so please consider resetting the password of the account
mentioned above.

and i am getting this error about 5 times a second.

more and more accounts at rondom are getting locked out and i cannot unlock
them. ever time i try to it simply locks them again!

this is causing huge dramas here.

i have been unable to find any desent infor on this error and what it means.

i have also checked the obvous hardware issues like it said, and also done
ever other this listed (EventCombMT.exe which only returns this ID), tried
re-applying service pack 4, manually kicked off replication, re-booted
ect.ect.

This error is only happening on the PDC emulator role, i have tried to move
it to another machine and the problem just followed.

any help at all would be much appreciated.

Thanks

Cameron

 

[mlichstein]

It sounds like someone is running some kind of password cracker on your network, since it is locking out most accounts.

Do you have auditing enabled?

 

[dbuttigieg]

Had exacttly the same problem. Eventually traced it to workgroup clients who were pointing to the DC for DNS. Removed DNS settings and error messages stopped instantly.