Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Userenv

Your roaming profile is not available, the operating system is attempting to log you on with your local profile. (<error code>)
While the event itself indicates the inability to access the roaming profile, the actual cause of the problem is better explained by the error code, so any attempt to troubleshoot this error should concentrate on the users' inability to access a network resource due to a cause explained by the error code. See the link to various error codes that may appear within the event description.

As per ME248368, a trailing blank space in the user profile path may cause this event.
- Error code: "The system cannot find the path specified" - Occurs at logon to a user account that is configured to use a roaming user profile. The user account has the correct NT permissions to load the profile (located at the network path specified in the Profile path field on the Profile tab of the user's account in Active Directory Users and computers) but the folder where the profile should be located is empty. Logon as an Administrator and make the profile available at this location.
Make sure, that the “C:\Documents and settings\Default Users” folder has permission to be read by the “Users” group, or whatever special group you are creating and to which the user that gets this error belongs.
In our case we run a DNS Server on our DC and used two forward "lookupzones" named "intranet" and "extranet". We have the error on our clients and on the other servers (sometimes in a distance to 5 minutes). Everything else in our domain worked fine. Except that we couldn’t use "dcpromo" to install the AD on other servers in our domain. Our fault was that our zones didn’t have the same name like our domain. So needed directories in our DNS-Zone in the forward lookup zone didn’t exist (like: "_msdcs", "_sites", "_tcp", "_udp"). These folders are needed service entries. Every service call from a machine to the server is looking in these folders. To fix the problem you should add a new forward lookup zone that is exactly like the machine suffix (domain name). Reboot the machine and wait up to 10 minutes. After that long period of time the zones where generated. Simply export your old zone and import if needed in the new one.
In my case this error occured due to a misconfiguration of the DNS server.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.