JSI Tip 3363. Event IDs 5716 and 5735 occur every 5 Minutes on all Windows NT 4.0 BDCs in your Windows 2000 domain?

If you installed Norton Ghost on a Windows 2000 PDC, all the Windows NT 4.0 BDCs receive the following events every 5 minutes:

Event Type: Warning 
Event Source: NETLOGON 
Event Category: None 
Event ID: 5716 
Description: The partial synchronization replication of the LSA database from the
             primary domain controller <\\PDCName> failed with the following error: 
             The parameter is incorrect. Data: 0000: 0d 00 00 c0 


Event Type: Error 
Event Source: NETLOGON 
Event Category: None 
Event ID: 5735 
Description: Replication of the LSA Account Object "S-1-5-21-1056396912-1606907188-1847928074-1895"
             from primary domain controller <PDCName> failed with the following error:
             The parameter is incorrect. Data: 0000: 0d 00 00 c0

To fix this behavior, remove the NGSERVER user account from the Deny logon locally user right in the Default Domain Controllers Group Policy Object ( GPO) on the Windows 2000 based primary domain controller.

NOTE: When you install Norton Ghost, it creates a NGSERVER user account and assigns it the following user rights in the Default Domain Controllers GPO:

Act as part of the operating system
Add workstations to domain
Deny logon locally
Log on as a batch job
Log on as a service
Shut down the system

Comments

Plain text