Event ID 12294
Being the belts and braces person I am I saw this in my daily morning check of the event viewer and browned my trousers because to me, this shows someone trying to logon as an Admin but clearly not succeeding - does anyone know if there are any other services / accounts which may trigger this.
Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.
They started at 06:54 and then gave up at 07:02
Have to had a read through these?
Thanks - did see that when I googled it - I am hoping it's because I left a RDP session open as I was running MS udpates on 3 of our 4 servers yesterday.