Background:

2 servers identically configured running server 2003 ent 64 bit edition.
Both DBS are MS SQL 2005 standard 64 bit. Publication and distribution
running on same server. Type of replication is merge replication. Snap-shot
folder is in a shared folder. VPN set up over Internet between two servers
on workgroup with same admin pwd and sa pwd. Reporting services not running
due to 32 bit ASP.net registered instead of 64 bit.

In the event viewer application log of subscriber I see Failure audit every
3-5 mins during usage of DB. Then it stops when my backup runs and starts
again after the backup.

event reads:

Event ID: 18456
Source: MSSQLSERVER

Login failed for user 'ComputerNameOfSubscriber\SQLaccount.' [CLIENT: <Local
Machine>]

another entry reads:

Login failed for user 'ComputerNameOfSubscriber\SQLaccount.' [CLIENT: IP
ADDRESS of Distributor]

SQLaccount is the account used to run SQLServer.

I also noticed in the both entries Hex the word 'Master' as in the Master
DB?. Not sure whats going on, all I know is the replication works but then
for some reason starts bulk copying all the data and locks my subscription
server from updating records (due to the Bulk copying).

There seem to be several factors here and we'll try to see what's occurring
:)
You have an account on the subscriber which is periodically connecting to
the distributor but failing is this another pull subscription?.
The normal synchronization works ok for your merge replication - pull or
push?.
There's a bulk-copy occuring at the subscriber - is there a reinitialization
being set off? Is there another publication involved?
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com
(recommended sql server 2000 replication book:
http://www.nwsu.com/0974973602p.html)

Yes subscriber is pull subscription, and it works most of the time, but then
descides to bulk copy every so often. After i told it that the subscription
never expires the bulk copy only happens about 1 every 3 weeks.

There is only one publication involved and one subscription. I dont know if
there is a reinitalization being set off, but it seems like it. Is there
anyway to check?

[quoted text, click to view]