General discussion

Locked

Event id 5718

By hanriky ·
Hello,
We use NT4 in our domain.
We have this event id in the event viewer in a BDC in Singapore office. And the replication between this bdc and our PDC
in Singapore failed. According to Technet, the cause of the event can be due to the Netlogon.chg file or the SAM database has become corrupt on the BDC. Technet recommends to resolve it by assigning
NO ACCESS for the System account to this file, restart the system and delete this file.

However, we tried by removing System account from this file, restarted the system but still could not delete this file. Can
anyone of you know how to delete this file? Is there a different between removing the account and assigning NO ACCESS for the
account?

Any comment is welcomed!
Hanrik

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Event id 5718

by BeerMonster In reply to Event id 5718

I went through this exact same scenario for a different company, in their case each of their 800 + shops had a BDC !! As you will know, the netlogon.chg is a special 64kb "circular" file that stores vector numbers that increment every time there is a change to the SAM, There is a similar file on the BDC's, which stores the vector number of the last update received. When a bdc is pulsed for replication it sends the vector number to the PDC, which checks it against it's own netlogon file. If the BDC's vector is the same as the last entry in the PDC's fle then the machines are in synch and no data is sent. Otherwise, the PDC searches it's file for the BDC's vector and sends every upodate in it's list SINCE that vector number. If the PDC can'tfind the BDC's vector, then it assumes the BDC's SAM is way out of date, and tells it to do a FULL synch. When the netlogon.chg file on the PDC corrupts, the vectors sent by the BDC's are (obviously) never found, with the result that EVERY BDC is told to do a FULL synch whenever it is pulsed by the PDC. Now times that by 800, over a national network ooooeerrr !! I seem to recall that we got round it the same way as yourselves, but with a slight difference. We took ownership of the file, denied EVERYBODY access (even us) and rebooted, then gave only us access to the file (IE the specific user), then deleted it. Upon next reboot, when the system could not find the file, it created another by default. This of course meant that all the machines went through one more full synch, but then things calmed down. Hope this helps.... If there is something strange going on with your PDC, and you still can't delete it, then try the ZAP.exe utility, which ships with the SMS reskit (I think it's in the BORK), that little gizmo will delete your house if you let it !!! If you need ZAP and can't get hold of a copy, then mail me at darthurs@hotmail.com

Hope it goes ok....

Collapse -

Event id 5718

by BeerMonster In reply to Event id 5718

BTW, when I say we denied everyone access, I mean that we took ALL entries out of the ACL, rather than selected deny access for each entry. On reboot, we added ourselves (as an user) back in : ) ...............

Collapse -

Event id 5718

by hanriky In reply to Event id 5718

Poster rated this answer

Collapse -

Event id 5718

by hanriky In reply to Event id 5718

This question was closed by the author

Back to Windows Forum
4 total posts (Page 1 of 1)  

Related Discussions

Related Forums