Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Windows cannot copy your profile because it contains encrypted files or directories. The keys to decrypt the files or directories are also stored in the profile and are not available now. Please decrypt the files and try again.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a user profile?
How are files and directories encrypted?
How can one determine what files or directories are encrypted?
What is the role of Userenv?
See ME255742 - "Methods for Recovering Encrypted Data Files"
The user has used EFS to encrypt part of their profile content e.g. Documents on their desktop. The system is unable to copy the content as it does not posses access to either the user or recovery agent keys. May happen in environments where the Default Recovery Policy has not benn defined or the data was encrypted on an alternative system. Use the XP version of the Cipher tool with the /N /U switches on the profile path to identify the encrypted files. Then use the Efsinfo tool to identify encrypter and recovery agent - decrypt the data.
|Private comment: Subscribers only. See example of private comment|
|Links: ME255742, ME243026|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (1) - More links...|
Send comments or solutions
- Notify me when updated