If you receive:
Event ID: 12288
Source: SAM
SAM failed to write changes to the database. This is most likely due to a memory or disk-space shortage. The SAM database will be restored to an earlier state. Recent changes will be lost. Check the disk-space available, maximum size setting, and maximum registry size setting.
Event ID: 5705
Source: Netlogon
The change to the cache maintained by the Netlogon service for database changes is corrupted. The Netlogon service is resetting the change log.
Event ID: 26
Source: Application Popup
System Process - Out of Virtual Memory: Your system is running low on virtual memory. Please close some applications. You can then start the System option in the Control Panel and choose the Virtual Memory button to create an additional paging file or to increase the size of your current paging file.
you are running out of room on the %SystemRoot% drive,
have pagefile(s) that are too small (tips 1394 and 0526),
Registry Size Limit is too low,
and/or your pagefile is too fragmented (See Diskeeper).
These conditions may corrupt your Netlogon.chg file. Delete it or see tip 0452. They may also cause any changes to the SAM to be lost.
Additionally, your PDC might stop authenticating users, passwords can't be changed, and new user accounts may not function.
You must correct these problems for your system to function.
In addition to the above links, you can:
1. Compress little used folders.
2. Move the TEMP folder (and associated TEMP and TMP environment variables).
3. Move the Spool folder.
4. Uninstall large applications and install them to another drive.
5. Search for .DMP files and delete them.
