Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Perflib

Source
Level
Description
Access to performance data was denied to <user name> as attempted from <calling module name>.
Comments
 
ME226494 was helpful in explaining the issue to me, but in my case the cure was to add the account from my WMI monitoring probe to the local admins group on the Windows 2000 server.
See the link to "WWW Tech Support Article ID: W15368" for a possible solution to this problem.
ME555129 provides information on this event.

If this problem appears when scanning a mapped drive using Norton AntiVirus Corporate Edition or Symantec AntiVirus Corporate Edition, then see the link to "Symantec Support Document ID:1999090808320248" for details on fixing the problem.
When access to performance data is required, the following key is checked for security access:
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
If the user associated with the client thread or process token is not on the ACL for this key then this event is posted. See ME226494.

In other words, Windows 2000 limits the access to performance data to user with administrators. If you attempt to access information from an unprivileged account, this event is recorded. In many instances of this event the user is ASPNET and by default this user does not have access to the registry key "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib".

Some other instances of this event are for the IUSR_<computer name> user (the account used by IIS login for anonymous connections). This user has limited rights to the file system.

This event is sometimes followed by event id 10003 from DCOM.

As per ME234860, Dr. Watson does not run with certain extensible counters.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...