SAM failed to write changes to the database 问题处理

问题：

Windows Storage Server 2012 R2 发布NAS服务，客户创建用户和组时报错，事件查看器系统日志下报错Event ID 12288，内容如下：

SAM failed to write changes to the database. This is most likely due to a
memory or disk-space shortage. The SAM database will be restored to an
earlier state. Recent changes will be lost. Check the disk-space available
and maximum pagefile size setting.

问题排查：

客户运行数据恢复软件，64G内存占用59G，pagfile 13G。根据官方12288事件介绍

建议客户关闭恢复软件，释放内存及缓冲文件。

问题解决：

客户关闭恢复软件，待1小时后，可以正常创建用户和组

参考链接：

http://kb.eventtracker.com/evtpass/evtPages/EventId_12288_SAM_48839.asp

Event Id
12288

Source
SAM

Description
SAM failed to write changes to the database. This is most likely due to a memory or disk-space shortage. The SAM database will be restored to an earlier state. Recent changes will be lost. Check the disk-space available, maximum size setting, and maximum registry size setting.

Event Information
According to Microsoft:
CAUSE:
This behavior occurs because the hard disk containing the %SystemRoot% folder is severely short of drive space. The physical RAM is depleted and the lack of free hard disk space does not allow Windows NT memory management to page less-used work out to the hard disk.
Additionally, the Pagefile.sys file is either not large enough or is severely fragmented. This causes the "out of virtual memory" error message on the server console. This may also cause users to experience problems when they attempt to change their password or gain access to the network.
RESOLUTION:
To resolve this issue, free up disk space for the operating system to function properly.Free up disk space on the affected drive on which the Pagefile.sys file is located. To free disk space on the boot partition, you can choose to move the Pagefile.sys file to another drive.You can gain additional space by moving files to other drives or deleting unnecessary files from the Temp folders. Purging the Temporary Internet Files folder of its contents can also free a considerable amount of space.

Reference Links
Event ID 12288 and 5705 on Primary Domain Controller Because Hard Disk Is Full on SystemRoot Drive
Event ID 12288 with Windows NT Server 3.51