Microsoft KB Archive/285796

= With Norton Ghost Installed, Event IDs 5716 and 5735 Occur Every 5 Minutes on All Windows NT 4.0 BDCs =

Article ID: 285796

Article Last Modified on 3/1/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q285796



SYMPTOMS
After you have installed the Norton Ghost software on a Windows 2000-based primary domain controller (PDC), all Microsoft Windows NT Server 4.0-based backup domain controllers (BDCs) in the domain may record the following error information in Event Viewer approximately every five minutes:

Event Type: Warning

Event Source: NETLOGON

Event Category: None

Event ID: 5716

Description: The partial synchronization replication of the LSA database from the primary domain controller \\DC000 failed with the following error: The parameter is incorrect. Data: 0000: 0d 00 00 c0

Event Type: Error

Event Source: NETLOGON

Event Category: None

Event ID: 5735

Description: Replication of the LSA Account Object &quot;S-1-5-21-1056396912-1606907188-1847928074-1895&quot; from primary domain controller DC000 failed with the following error: The parameter is incorrect. Data: 0000: 0d 00 00 c0



RESOLUTION
To resolve this behavior, remove the NGSERVER user account from the &quot;Deny logon locally&quot; user right in the Default Domain Controllers Group Policy Object (GPO) on the Windows 2000-based domain controller.



MORE INFORMATION
The Norton Ghost software creates a user account named NGSERVER and assigns it the following user rights in the default GPO on the Windows 2000-based domain controller:


 * Act as part of the operating system
 * Add workstations to domain
 * Deny logon locally
 * Log on as a batch job
 * Log on as a service
 * Shut down the system

The &quot;Deny logon locally&quot; user right causes the cited errors.

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

For information about how to contact Symantec, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and Software Third-Party Vendor Contact List, A-K

60781 Hardware and Software Third-Party Vendor Contact List, L-P

60782 Hardware and Software Third-Party Vendor Contact List, Q-Z

Keywords: kbprb KB285796

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.