From: Andrew.Ogden on
Did you ever find a solution to this issue?

I have been experiencing the same thing since changing our domain admin

Enabling the logging only shows me that the failed login attempts originate
from the DC logging the errors. I have been through my services ten times to
ensure none are left with the old password.

"MC" wrote:

> Hi,
> I see in system even log SAM database error messages saying that Account
> Can't be locked, due to resource error
> Event ID:12294, and that account is domain\administrator
> That means something or someone is trying to logon to domain as
> administrator but failing. (also can't lock the account, because I
> disabled). How I find from what IP or workstation these attempt being made?
> Event log doesn't mention
> Thanks
> MC