Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Userenv

Windows cannot load the user's profile but has logged you on with the default profile for the system.

DETAIL - <error description>
I had tried all of the solutions here but nothing resolved this issue. What finaly worked for me was to install UPHClean (Microsoft User Profile Hive Cleanup Service). See ME837115.
As per Microsoft: "This error can occur if the user profile registry hive gets corrupted or if permissions are set incorrectly on the profile folders". See MSW2KDB, ME834647, and ME195234 for details on this error.
I found this was happening on a system that had a logon script set for a domain account; however the user was logging in locally. The username was the same for both local and domain account. After I removed the login script from profile, the error message stopped happening on the local account.
Error: "Not enough storage is available to process this command." - From a newsgroup post: "It seems like you have a roaming profile that resides on a server. It cannot be copied to your machine for some reason. Permissions? Disk full? Have you exceeded your space quota? All of these would generate your error message.". Please note that "storage" does not necessarely mean hard disk space. It could mean registry size limitations and other software-based settings."

Error: "The system has attempted to load or restore a file into the registry but the specified file is not in a registry file format." - no info
Check to see if Port Fast is enabled on your switch. If it is not and the user tries to log on right away after the switch is started, you may get this error.

I found out what file was causing the problem, UsrClass.dat, and I found it residing in
C:\Documents and Settings\Current User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
Where the Current User  is the user logged in to the network at the moment). Move the file out of that directory and log back in (it doesn’t matter where you move it to as long as you know, just in case it wouldn’t work). The file is going to be recreated and this will eliminate the login error the user was getting. When everything is working fine, just delete the old UsrClass.dat file.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.