JSI Tip 3363. Event IDs 5716 and 5735 occur every 5 Minutes on all Windows NT 4.0 BDCs in your Windows 2000 domain?

If you installed Norton Ghost on a Windows 2000 PDC, all the Windows NT 4.0 BDCs receive the following events every 5 minutes:

Event Type: Warning Event Source: NETLOGON Event Category: None Event ID: 5716 Description: The partial synchronization replication of the LSA database from the             primary domain controller <\PDCName> failed with the following error:              The parameter is incorrect. Data: 0000: 0d 00 00 c0 Event Type: Error Event Source: NETLOGON Event Category: None Event ID: 5735 Description: Replication of the LSA Account Object "S-1-5-21-1056396912-1606907188-1847928074-1895"             from primary domain controller  failed with the following error:             The parameter is incorrect. Data: 0000: 0d 00 00 c0

To fix this behavior, remove the NGSERVER user account from the Deny logon locally user right in the Default Domain Controllers Group Policy Object (GPO) on the Windows 2000 based primary domain controller.

NOTE: When you install Norton Ghost, it creates a NGSERVER user account and assigns it the following user rights in the Default Domain Controllers GPO:

Act as part of the operating systemAdd workstations to domainDeny logon locallyLog on as a batch jobLog on as a serviceShut down the system