Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Userenv

Windows did not load your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Windows did not load your profile because a server copy of the profile folder already exists that does not have the correct security. Either the current user or the Administrator's group must be the owner of the folder. Contact your network administrator.
This problem can be caused by bugs either in Microsoft software or third-party software (printer drivers, virus scanner service, etc.). In order to resolve this problem you need to identify what software is causing the profile to fail to unload. "Citrix Support Document ID: CTX105618" provides several causes for this problem accompanied with a suggested resolution.
I had the problem after installing Win2k SP4 on my machines. After searching through Microsoft’s KB, I found ME327462. It appears that in Windows XP SP1 and Windows 2000 SP4 a new check is introduced, for checking existing roaming user profiles folders. When disabling this check al the problems where solved.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.