Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Userenv

Windows cannot copy file <path to source file> to location <path to destination file>. Contact your network administrator. DETAIL - <detail description>
Detail: "Access is denied" - Occurs at logon to a user account that is configured to use a roaming user profile. The user account does not have the correct NT permissions to load a file in the profile (located at the network path specified in the Profile path field on the Profile tab of the user's account in Active Directory Users and computers). In one case, the file was copied to the profile path by an Administrator, but the folder for profile did not have sufficient NT permissions to allow the user to read it.
Resolution: Logon as an Administrator and give the user the Full Control NT permission of the profile folder for the user.
- Detail: "The filename or extension is too long" - This problem occurs at logon to a user account that is configured to use a roaming profile. The profile folder contains a file with a file name that is too long to be copied with a full path name.
For example this can be caused by a file in C:\Documents and Settings\{username}\Application Data\Microsoft\Office\Recent that is a shortcut (with a ".LNK" extension) to a document located elsewhere.
Resolution: Logon as an Administrator with a different account name and delete or rename the file name that is too long. If this cannot be done with Windows Explorer then do this from the Windows 2000 command line by using the CD command with a relative directory name to navigate to the file and delete it with the DEL command. If this does not work move any files/folders that are wanted use the "CD .." command to go up one level delete the folder (e.g. with the RD Recent /S command) and recreate an empty folder (e.g. with the MD Recent command).
If the file named in the message is a shortcut (with a ".LNK" extension) to a document located elsewhere then shorten the name of the document so that the error does not happen again. Shorten the name of any other documents that may cause this error.
- Detail: "The process cannot access the file because it is being used by another process" - In one case, an attempt was made to copy a profile to the Default User's profile via the My Computer, Properties and the User Profiles tab. A file within the profile being copied was in use by Windows.
Resolution: Stop the Indexing service or other process that has the file open and try again. Restart the computer in some form of Safe Mode and try again. On some computers, the User Profile Hive Cleanup Service has been found to cause this problem and needs to be uninstalled and the computer restarted before the profile can be copied. Reinstall it afterwards.
Zone Alarm can cause this problem as it locks files associated with the default user profile. Uninstalling Zone Alarm allows the profile to be created successfuly.
- Detail: "Cannot create a file when that file already exists". As per Microsoft: "This problem may occur if the Indexing service or some other process (such as an open file agent) has opened the indicated temporary file during profile synchronization". See ME328607 for more detailed information.
- Detail: "The process cannot access the file because it is being used by another process" - See ME321936 for a hotfix applicable to Microsoft Windows 2000.
After upgrading NetShield 4.5 to VirusScan 7.0.0, we had this error at logon and logoff. After calling NAI, they sent to us CommonFrameWork 3.1. After installing 3.1 there are no more errors (VirusScan 7.1.0 already includes CommonFramework 3.1 but we had problems with the AlertManager in ActiveDirectory).
Detail: "The process cannot access the file because it is being used by another process.": From a newsgroup posting: "In order to get rid of these messages I had to stop the Norton AntiVirus Services.".

Detail: "The file or directory is corrupted and unreadable." - Some newsgroup posts suggest running a chkdsk for the drive specified in the event description.

Detail: "Access is Denied" - You get "access denied" everytime a file with read-only attribute is  trying to be copied to \\%server%\profiles\%profilename%.
In my case Windows could not copy file \\ussjfs1\profile$\meritadmin\ntuser.pol.tmp to location N:\Documents and Settings\misadmin\ntuser.pol.tmp. To resolve the problem I deleted Profile \ussjfs1\profile$\meritadmin\ including meritadmin directory. Recreated in AD users and computers. The next time I logged in the problem was gone.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.