Looks like it could be LSA corruption:
Recovering from Minor LSA Corruption
http://support.microsoft.com/default...b;en-us;199071
Yes it is
"Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5732
Date: 8/4/2004
Time: 12:20:55 PM
User: N/A
Computer: AR01BDC06
Description:
Replication of the SAM User "X125214" from primary domain
controller AR01PDC01 failed with the following error:
The transaction state of a registry subtree is
incompatible with the requested operation.
Data:
0000: 1c 01 00 c0 ..À
"
The account user can be another too. the event is no only
for this user
and have others events like this
"Replication of the LSA Policy Object "Policy" from
primary domain controller AR01PDC01 failed with the
following error:
An I/O operation initiated by the registry failed
unrecoverably. The registry could not read in, or write
out, or flush, one of the files that contain the system's
image of the registry. "
I'm logging netlogon activity and have this event log
"ba8
AccountName = BA-ZFHYL$
DesiredAccess = 0
AccountHandle = 204fe88
ConflictingAccountRid = ba8
08/04 14:04:49 [SYNC] SamICreateAccountByRid returning
c000011c
08/04 14:04:49 [CRITICAL] Unsuccessful NlUnpackSam: Status
(c000011c)
08/04 14:04:49 [MISC] Eventlog: 5732 (1) "SAM" "BA-
ZFHYL$" "AR01PDC01" "%%1369" c000011c
08/04 14:04:50 [SYNC] UnPacking User Object (b5a)
ARXCBA01WS04$
08/04 14:04:50 [SYNC] Parameters to SamICreateAccountByRid:
DomainHandle = 19ba28
AccountType = 1
RelativeId = b5a
AccountName = ARXCBA01WS04$
DesiredAccess = 0
AccountHandle = 204fe88
ConflictingAccountRid = b5a
08/04 14:04:50 [SYNC] SamICreateAccountByRid returning
c000011c
08/04 14:04:50 [CRITICAL] Unsuccessful NlUnpackSam: Status
(c000011c)
"
And i see a 'little' detail...
this BDC is trying continuously to replicate with the
PDC. Appears to be a registry key error , but i see the
security\ sam subkeys in the bdc registry and i saw these
ok
The SP versions on both are sp6a, with many hotfixs boths