FileMon, RegMon from www.sysinternals.com to monitor which file(s), registry is being accessed
if want to know which AD object is being accessed, use netmon

also fport.exe to monitor TCP/IP ports

DLL Help Database
http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp&SD=TECH&FR=0

Event ID .net

w2000msgs.chm in support tools

how to delete system protected object:
1. Add "Allow System Only" key to register under "hklm\system\CCS\...???"
2. use ADSI edit to delete it

using "repadmin /syncall object nam" to see underlying replication issue
use "replmon" see if replication happening