The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure

Question

Found several errors in the event viewer, and it makes no sense.

The SAM database was unable to lock out the account of the Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above

Answer 1

Follow https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ntds-replication-warning-1083-1061-sam-error-12294

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Hello John Cahill，

Thank you for posting in Q&A forum.

Based on the description, it seems the built-in Domain Administrator account will be locked out when the wrong logon times meet lockout threshold within account lockout policy.

Based on my experiences, the built-in Administrator account cannot be locked out (internal mechanisms prohibit this). But effectively it’s similar to a lockout - something or someone is using a wrong password (or outdated password after you changed it) to login to this account.

You can check if the built-in Domain Administrator is locked out or not.

If it is locked out, you can unlock it. And then try to check which app/program/process on which machine locked this account (no matter the administrator account is locked out or not).

And then check if you can see event ID 4740 on this machine (it means a user account was locked out) on Domain Controller. The call computer name is the machine locked this account.

[https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4740 ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4740

)

On this machine, try to check which app/program/process locked this account via Event ID 4625.

If you find which client machine locked the account, we can try to check if the account lockout issue (or several wrong logon attempt) is caused by any one of the following information.

•Check the credential management to see if there is cached user’s old credentials

•Check if you have used the wrong password to mount the network disk

•Check whether the user has used the wrong password to start services, run scheduled tasks, etc. •Check if there are other third-party programs that cache the user’s wrong password.

If the call computer name is blank, you can try to check Event ID 4776 (NTLM authentication) or Event ID 4771 (Kerberos authentication) before the event ID 4740 occurred.

Please note: Logon has serval different types, here you can see detailed iformation.

https://learn.microsoft.com/en-us/windows-server/identity/securing-privileged-access/reference-tools-logon-types

Here is one similar thread for your reference.

https://community.spiceworks.com/t/administrator-account-lockout/735774/26

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.