Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Windows cannot load the user's profile but has logged you on with the default profile for the system.
DETAIL - <error description>
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a user profile?
What is a default system profile?
What is the role of Userenv?
I had tried all of the solutions here but nothing resolved this issue. What finaly worked for me was to install UPHClean (Microsoft User Profile Hive Cleanup Service). See ME837115.
As per Microsoft: "This error can occur if the user profile registry hive gets corrupted or if permissions are set incorrectly on the profile folders". See MSW2KDB, ME834647, and ME195234 for details on this error.
I found this was happening on a system that had a logon script set for a domain account; however the user was logging in locally. The username was the same for both local and domain account. After I removed the login script from profile, the error message stopped happening on the local account.
Error: "Not enough storage is available to process this command." - From a newsgroup post: "It seems like you have a roaming profile that resides on a server. It cannot be copied to your machine for some reason. Permissions? Disk full? Have you exceeded your space quota? All of these would generate your error message.". Please note that "storage" does not necessarely mean hard disk space. It could mean registry size limitations and other software-based settings."
Error: "The system has attempted to load or restore a file into the registry but the specified file is not in a registry file format." - no info
Check to see if Port Fast is enabled on your switch. If it is not and the user tries to log on right away after the switch is started, you may get this error.
I found out what file was causing the problem, UsrClass.dat, and I found it residing in
C:\Documents and Settings\Current User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
Where the Current User is the user logged in to the network at the moment). Move the file out of that directory and log back in (it doesn’t matter where you move it to as long as you know, just in case it wouldn’t work). The file is going to be recreated and this will eliminate the login error the user was getting. When everything is working fine, just delete the old UsrClass.dat file.
|Private comment: Subscribers only. See example of private comment|
|Links: ME195234, ME834647, ME837115, User Profile Does Not Roam, MSW2KDB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (1) - More links...|
Send comments or solutions
- Notify me when updated