| Event Id | 12288 |
| Source | SAM |
| Description | SAM failed to write changes to the database. This is most likely due to a memory or disk-space shortage. The SAM database will be restored to an earlier state. Recent changes will be lost. Check the disk-space available, maximum size setting, and maximum registry size setting. |
| Event Information | According to Microsoft: CAUSE: This behavior occurs because the hard disk containing the %SystemRoot% folder is severely short of drive space. The physical RAM is depleted and the lack of free hard disk space does not allow Windows NT memory management to page less-used work out to the hard disk. Additionally, the Pagefile.sys file is either not large enough or is severely fragmented. This causes the "out of virtual memory" error message on the server console. This may also cause users to experience problems when they attempt to change their password or gain access to the network. RESOLUTION: To resolve this issue, free up disk space for the operating system to function properly.Free up disk space on the affected drive on which the Pagefile.sys file is located. To free disk space on the boot partition, you can choose to move the Pagefile.sys file to another drive.You can gain additional space by moving files to other drives or deleting unnecessary files from the Temp folders. Purging the Temporary Internet Files folder of its contents can also free a considerable amount of space. |
| Reference Links | Event ID 12288 and 5705 on Primary Domain Controller Because Hard Disk Is Full on SystemRoot Drive Event ID 12288 with Windows NT Server 3.51 |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.