JSI Tip 8888. Your user accounts are unexpectedly locked and event ID 12294 is logged in Windows Server 2003?

The subject behavior will occur even if the user has not entered an incorrect logon name or password, and will even occur on the first logon attempt.

The Windows Server 2003 event log records:

Event Type: Error
Event Source: SAM
Event Category: None
Event ID: 12294
Date: MM/DD/YYYY
Time: HH:MM:SS
Description: The SAM database was unable to lockout the account of ? due to a resource error, such as a hard disk write failure (the specific error code is in the error data). Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.
Data: 0000: ......

This behavior will occur if a computer on your network is infected with the W32.Randex.F worm or one of its' variants.

To resolve this behavior:

1. Update your virus definitions.

2. perform a complete virus scan on your network.