Event ID 5735 Logged on all Windows NT 4.0 Backup Domain Controllers in a Windows 2000 Domain (275606)

SYMPTOMS

You may receive the following event ID 5735 in the event logs of all Microsoft Windows NT 4.0-based backup domain controllers (BDCs) every five minutes:

Event Type: Error
Event Source: Netlogon
Event Category: None
Event ID: 5735
Date: 5/14/2000
Time: 2:02:28 PM
User: N/A
Computer: MDM_STL01
Description:
Replication of the LSA Account Object "S-1-5-21-1056396912-1606907188-1847928074-1895" from primary domain controller DC000 failed with the following error: The parameter is incorrect.

NOTE: The Security Identifier of the user may not be the same as the Security Identifier shown in the sample event description.

CAUSE

This behavior may occur if you have installed either Norton Ghost 2001 or Symantec Ghost 6.5 Enterprise Edition software on your system. These software can create a user account which populates several default Domain Policy policies.

RESOLUTION

To resolve this behavior, you must remove the preceding Ghost software and remove the user account (S-1-5-21-1056396912-1606907188-1847928074-1895) created by this software from the following policies:

Act as part of the operating system.
Add workstation to domain.
Deny log on locally.
Log on as a batch job.
Log on as a service.
Shut down system.

MORE INFORMATION

To access the default Domain Controller Policy, perform the following steps:

Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
Right-click Domain Controllers.
Click Properties.
Click the Group Policy tab.
Double-click Default Domain Controllers Policy.
On the Default Domain Controllers Policy, click Edit.
Under the Computer Configuration icon, click Windows Settings, click Security settings, click Local Policy, and then click User Rights Assignment.

NOTE: In the preceding location you can find the policies that you need to remove the account created by the preceding Ghost software.

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.