Miscellaneous SAM Errors

[Robert Snyder]

I'm getting the following alert 2-3 times a day on just one of the 60-some
DC's that I'm monitoring.

The SAM database was unable to lockout the account of xxxxxx due to a
resource error, such as a hard disk write failure (the specific error code is
in the error data) . Accounts are locked after a certain number of bad
passwords are provided so please consider resetting the password of the
account mentioned above.

I'm stumped why I'm getting this. They did seem to start shortly after I
upgraded the DC to W2K3 SP1. I saw one explanation was that I needed to
upgrade my AD MP but I've reinstalled it with the latest one from MS web site
and still get the errors. Plus if that were the case I would have thought I'd
get the same error on other DC's but I only get it on the one. I've tried
uninstalling and re-installing the agent as well but no luck.

I've seen references to Q306091. It just says I must analyze the data to
determine the error, but it doesn't tell me what the data values mean.

I did verify there doesn't seem to be any problem with the physical disks.

The account xxxxxx is diffeent everytime that the alert is generated and
there is no commonality to the userids that appear, so I find it highly
doubtful it is any kind of attack.

I saw something that suggested a couple worms that could cause this but I
have the latest virus definition files and have done a scan of the DC andf
everything checks out clean.

Has anyone seen this alert occur and have any other ideas as to why it is
happening.

[Andy McConnell]

I am seeing this error as well, and have gone through the same process as you
in checking everything out and nothing seems to give any real indication of
the root of the problem or where to look to troubleshoot it. Some differences
though, I have only used the latest of the MP for AD and DCs are not SP1.

Post by Robert Snyder
I'm getting the following alert 2-3 times a day on just one of the 60-some
DC's that I'm monitoring.
The SAM database was unable to lockout the account of xxxxxx due to a
resource error, such as a hard disk write failure (the specific error code is
in the error data) . Accounts are locked after a certain number of bad
passwords are provided so please consider resetting the password of the
account mentioned above.
I'm stumped why I'm getting this. They did seem to start shortly after I
upgraded the DC to W2K3 SP1. I saw one explanation was that I needed to
upgrade my AD MP but I've reinstalled it with the latest one from MS web site
and still get the errors. Plus if that were the case I would have thought I'd
get the same error on other DC's but I only get it on the one. I've tried
uninstalling and re-installing the agent as well but no luck.
I've seen references to Q306091. It just says I must analyze the data to
determine the error, but it doesn't tell me what the data values mean.
I did verify there doesn't seem to be any problem with the physical disks.
The account xxxxxx is diffeent everytime that the alert is generated and
there is no commonality to the userids that appear, so I find it highly
doubtful it is any kind of attack.
I saw something that suggested a couple worms that could cause this but I
have the latest virus definition files and have done a scan of the DC andf
everything checks out clean.
Has anyone seen this alert occur and have any other ideas as to why it is
happening.

[Stuart [MVP]]

I've seen these too and never found a cause either.

Stuart.
---------

Post by Andy McConnell
I am seeing this error as well, and have gone through the same process as you
in checking everything out and nothing seems to give any real indication of
the root of the problem or where to look to troubleshoot it. Some differences
though, I have only used the latest of the MP for AD and DCs are not SP1.

Post by Robert Snyder
I'm getting the following alert 2-3 times a day on just one of the 60-some
DC's that I'm monitoring.
The SAM database was unable to lockout the account of xxxxxx due to a
resource error, such as a hard disk write failure (the specific error code is
in the error data) . Accounts are locked after a certain number of bad
passwords are provided so please consider resetting the password of the
account mentioned above.
I'm stumped why I'm getting this. They did seem to start shortly after I
upgraded the DC to W2K3 SP1. I saw one explanation was that I needed to
upgrade my AD MP but I've reinstalled it with the latest one from MS web site
and still get the errors. Plus if that were the case I would have thought I'd
get the same error on other DC's but I only get it on the one. I've tried
uninstalling and re-installing the agent as well but no luck.
I've seen references to Q306091. It just says I must analyze the data to
determine the error, but it doesn't tell me what the data values mean.
I did verify there doesn't seem to be any problem with the physical disks.
The account xxxxxx is diffeent everytime that the alert is generated and
there is no commonality to the userids that appear, so I find it highly
doubtful it is any kind of attack.
I saw something that suggested a couple worms that could cause this but I
have the latest virus definition files and have done a scan of the DC andf
everything checks out clean.
Has anyone seen this alert occur and have any other ideas as to why it is
happening.