If you installed Norton Ghost on a Windows 2000 PDC, all the Windows NT 4.0 BDCs receive the following events every 5 minutes:
Event Type: Warning Event Source: NETLOGON Event Category: None Event ID: 5716 Description: The partial synchronization replication of the LSA database from the primary domain controller <\\PDCName> failed with the following error: The parameter is incorrect. Data: 0000: 0d 00 00 c0 Event Type: Error Event Source: NETLOGON Event Category: None Event ID: 5735 Description: Replication of the LSA Account Object "S-1-5-21-1056396912-1606907188-1847928074-1895" from primary domain controller <PDCName> failed with the following error: The parameter is incorrect. Data: 0000: 0d 00 00 c0To fix this behavior, remove the NGSERVER user account from the Deny logon locally user right in the Default Domain Controllers Group Policy Object ( GPO) on the Windows 2000 based primary domain controller.
NOTE: When you install Norton Ghost, it creates a NGSERVER user account and assigns it the following user rights in the Default Domain Controllers GPO:
Act as part of the operating system Add workstations to domain Deny logon locally Log on as a batch job Log on as a service Shut down the system