On my NT 4.0 LAN I keep Norton Antivirus up to date. I use the latest patches. Norton has caught Nimda a few times when innocent users have visited infected web sites. I have done file scans and looked at the registry of my servers, and from what I can tell I am not infected, but coincidentally two days ago I started to experience some strange behaviour on my PDC: I noticed the browse list was not complete. When I opened server manager on a machine other than the PDC it would time-out saying "cannot locate D," yet the PDC was still on the network, network shares working normally. When I entered a new user, the account information did not replicate out to the other servers. I found no help in technet. Eventually I restored the registry from the previous night's backup and everything was OK. But then the same thing happened the next day (yesterday) and I had to do the restore again. This PDC is quite new, straight-up NT 4.0 with SP6a. I haven't installed any applications other than NAV, and all it does it login authentication and printer and file sharing. I am concerned about this strange behaviour. Any ideas what is happening or what else I should check? JJ _____________________________________________________________ Are you a Techie? Get Your Free Tech Email Address Now! Visit http://www.TechEmail.com