This KB article on MS's support site makes me a little nervous. If I am reading it right, if an application (or a person) somehow sticks an invalid entry into AD, you effectively stop replication until you fix it up correctly. Unfortunately, it looks like 'fixing it' isn't that easy based on what is written there.
I don't want to be an alarmist or a 'tin-foil-hat' guy, but it sounds like a potentially serious problem from 2000 machines if some sort of worm gets admin rights, sticks in a few AD entries in on a domain controller, and goes on its merry way.
You probably wouldn't notice the problem right away since it would just log a few entries everytime the system does garbage collection and/or tries to replicate AD.
http://support.microsoft.com/kb/907462
