replication help

[KK]

Hi,
i have been getting this error message from several days on one of my domain
controllers,as far as i know.. we have not changed the administrator
password.
IN system Event

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: 11/26/2003
Time: 8:13:39 AM
User: FICWORKGROUP\Administrator
Computer: WADDC02
Description:
The SAM database was unable to lockout the account of ? due to a resource
error, such as a hard disk write failure (the specific error code is in the
error data) . Accounts are locked after a certain number of bad passwords
are provided so please consider resetting the password of the account
mentioned above.
Data:
0000: c00002a5

and in Directory Services log

Event Type: Warning
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1083
Date: 11/26/2003
Time: 9:51:31 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: WADDC02
Description:
Replication warning: The directory is busy. It couldn't update object
CN=Administrator,CN=Users,DC=corp,DC=register,DC=com with changes made by
directory cc5f0d3c-b34e-4d55-a516-88a3c817c227._msdcs.corp.register.com.
Will try again later.


I checked with repadmin utility,it is showing no issues.
I checked with lockoutstatus utility, which is also showing no issue with
admin account.
ADUC is also showing the account to be not locked out.

What should I check ?
Thanks
GK

Q how do you i make sure that this wont

 

[Karin Galli [MS]]

This article applies to the IDs you see in your DC:

306091 Description of NTDS Replication Warning IDs 1083 and 1061, and SAM
Error
http://support.microsoft.com/?id=306091

Cheers!

 

[Karin Galli [MS]]

Also check this:

 

[Karin Galli [MS]]

A malicious user may be attempting to logon to the machine by brute
force'ing the

password



The SAM event indicates that the enough attempts were made on the
administrator

account to cross the Account lockout threshold. as the administrator cannot
be

locked out, this event is logged instead.



_Suggested_ actions for the customer _may_ include



keep security patches up to date



configure restrictanonymous to be 1 or 2 (do not set 2 in an environment
with NT 4

machines)



change administrator password and the password on all administrative level

accounts



rename administrator account (and possible other admin accounts)



Cheers!

 

[femi]

Hello,

some useful information cab be found at
http://www.eventid.net/display.asp?eventid=12294&source=

Hopes this helps.
Femi