Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The logged on user's forest is different from the machine's forest. Cross Forest Group Policy processing is disabled and loopback processing has been enforced in this forest for this user account.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of Userenv?
I have W2K clients that log on locally, and then connect via ADSL to Citrix on W2K SP4. This entry appears in the Citrix server event log. Apparently, Win2k SP4 and 2003 Server include a new GPO setting: “Computer Configuration\Administrative Templates\System\Group Policy\Allow Cross-Forest User Policy and Roaming Profiles”. This is disabled by default, and should be enabled if you have cross-forest trusts for policies and login scripts. See ME823862 for more details. Similar entries can be caused by "disjointed namespace" following server promotion to a domain controller. See ME257623 for more details.
|Private comment: Subscribers only. See example of private comment|
|Links: ME257623, ME823862|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (1) - More links...|
Send comments or solutions
- Notify me when updated