Prev: server shutdown unexpectedly
Next: Server 2008 Update Error
From: Paul on 12 Apr 2010 06:55
Hi,

Since changing our domain admin and local admin password we get EventID
12294 SAM errors logged in our system logs on the 2 domain controllers.

The error is The SAM database was unable to lockout the account
[]........(the other account on the other dc lists as ? in the event ID)

I've checked all services using domain admin and all are running, servers
have all been rebooted.

Turning up security logging reveals the userID Administrator fails on krbtgt
with pre-authentication and error code 0x18. Yet we've not changed this.

Any ideas?

Thanks

Paul




From: Meinolf Weber [MVP-DS] on 12 Apr 2010 07:41
Hello Paul,

Start here:
http://support.microsoft.com/kb/306091

http://support.microsoft.com/kb/887433

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi,
>
> Since changing our domain admin and local admin password we get
> EventID 12294 SAM errors logged in our system logs on the 2 domain
> controllers.
>
> The error is The SAM database was unable to lockout the account
> []........(the other account on the other dc lists as ? in the event
> ID)
>
> I've checked all services using domain admin and all are running,
> servers have all been rebooted.
>
> Turning up security logging reveals the userID Administrator fails on
> krbtgt with pre-authentication and error code 0x18. Yet we've not
> changed this.
>
> Any ideas?
>
> Thanks
>
> Paul
>


From: Paul on 14 Apr 2010 04:09
Hello,

I checked those articles and our servers are replicating okay. I've also ran
full virus scans on the network and it's clean.

Is there a way to find out where this is originating from as the events have
now switched to another DC, suggesting that something is authenticating
using incorrect credentials, and the eventcombmt tool just highlights what's
already in the event logs.

Thanks

"Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote in message
news:6cb2911df7fb8cca85cf996ef50(a)msnews.microsoft.com...
> Hello Paul,
>
> Start here:
> http://support.microsoft.com/kb/306091
>
> http://support.microsoft.com/kb/887433
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hi,
>>
>> Since changing our domain admin and local admin password we get
>> EventID 12294 SAM errors logged in our system logs on the 2 domain
>> controllers.
>>
>> The error is The SAM database was unable to lockout the account
>> []........(the other account on the other dc lists as ? in the event
>> ID)
>>
>> I've checked all services using domain admin and all are running,
>> servers have all been rebooted.
>>
>> Turning up security logging reveals the userID Administrator fails on
>> krbtgt with pre-authentication and error code 0x18. Yet we've not
>> changed this.
>>
>> Any ideas?
>>
>> Thanks
>>
>> Paul
>>
>
>


 | 
Pages: 1
Prev: server shutdown unexpectedly
Next: Server 2008 Update Error