With Norton Ghost Installed, Event IDs 5716 and 5735 Occur Every 5 Minutes on All Windows NT 4.0 BDCs (285796)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server
This article was previously published under Q285796

SYMPTOMS

After you have installed the Norton Ghost software on a Windows 2000-based primary domain controller (PDC), all Microsoft Windows NT Server 4.0-based backup domain controllers (BDCs) in the domain may record the following error information in Event Viewer approximately every five minutes:
Event Type: Warning
Event Source: NETLOGON
Event Category: None
Event ID: 5716
Description: The partial synchronization replication of the LSA database from the primary domain controller \\DC000 failed with the following error: The parameter is incorrect. Data: 0000: 0d 00 00 c0

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5735
Description: Replication of the LSA Account Object "S-1-5-21-1056396912-1606907188-1847928074-1895" from primary domain controller DC000 failed with the following error: The parameter is incorrect. Data: 0000: 0d 00 00 c0

RESOLUTION

To resolve this behavior, remove the NGSERVER user account from the "Deny logon locally" user right in the Default Domain Controllers Group Policy Object (GPO) on the Windows 2000-based domain controller.

MORE INFORMATION

The Norton Ghost software creates a user account named NGSERVER and assigns it the following user rights in the default GPO on the Windows 2000-based domain controller:

  • Act as part of the operating system
  • Add workstations to domain
  • Deny logon locally
  • Log on as a batch job
  • Log on as a service
  • Shut down the system

The "Deny logon locally" user right causes the cited errors.

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.


For information about how to contact Symantec, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and Software Third-Party Vendor Contact List, A-K

60781 Hardware and Software Third-Party Vendor Contact List, L-P

60782 Hardware and Software Third-Party Vendor Contact List, Q-Z

Modification Type:MajorLast Reviewed:11/19/2003
Keywords:kbprb KB285796
©2003 Microsoft Corporation. All rights reserved.