Microsoft KB Archive/275606

= Event ID 5735 Logged on all Windows NT 4.0 Backup Domain Controllers in a Windows 2000 Domain =

Article ID: 275606

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT 4.0 Service Pack 5
 * Microsoft Windows NT 4.0 Service Pack 6
 * Microsoft Windows NT 4.0 Service Pack 6a

-



This article was previously published under Q275606



SYMPTOMS
You may receive the following event ID 5735 in the event logs of all Microsoft Windows NT 4.0-based backup domain controllers (BDCs) every five minutes:

Event Type: Error

Event Source: Netlogon

Event Category: None

Event ID: 5735

Date: 5/14/2000

Time: 2:02:28 PM

User: N/A

Computer: MDM_STL01

Description:

Replication of the LSA Account Object &quot;S-1-5-21-1056396912-1606907188-1847928074-1895&quot; from primary domain controller DC000 failed with the following error: The parameter is incorrect.

NOTE: The Security Identifier of the user may not be the same as the Security Identifier shown in the sample event description.



CAUSE
This behavior may occur if you have installed either Norton Ghost 2001 or Symantec Ghost 6.5 Enterprise Edition software on your system. These software can create a user account which populates several default Domain Policy policies.



RESOLUTION
To resolve this behavior, you must remove the preceding Ghost software and remove the user account (S-1-5-21-1056396912-1606907188-1847928074-1895) created by this software from the following policies:
 * Act as part of the operating system.
 * Add workstation to domain.
 * Deny log on locally.
 * Log on as a batch job.
 * Log on as a service.
 * Shut down system.



MORE INFORMATION
To access the default Domain Controller Policy, perform the following steps:
 * 1) Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
 * 2) Right-click Domain Controllers.
 * 3) Click Properties.
 * 4) Click the Group Policy tab.
 * 5) Double-click Default Domain Controllers Policy.
 * 6) On the Default Domain Controllers Policy, click Edit.
 * 7) Under the Computer Configuration icon, click Windows Settings, click Security settings, click Local Policy, and then click User Rights Assignment.

NOTE: In the preceding location you can find the policies that you need to remove the account created by the preceding Ghost software.

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Keywords: kb3rdparty kberrmsg kbprb KB275606

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.