Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Userenv

Source
Level
Description
Your profile was not successfully loaded, but you have been logged on with the default system profile. Please correct the problem and log off. (<error code>)
Comments
 
The event itself just indicates that there was a problem accessing the user profile. The actual reason for that is hidden behind the error code show in the event description. Depending on that code, different actions can be taken to fix the problem. See the links for the error codes for suggestions on what is causing them and how to troubleshoot them.
I had the same problem when debugging EventID 2019 from source SRV. The registry size had been set to 24 MB after which EventID 1000 from source Userenv appeared. Going back to 96 MB (or even more) solved the problem.
I had this trouble with a client, each time they logged on the profile number would increment i.e. user.000, user.001, user.002 etc. and they would get the Event 1000. I found the last lines of MSKB article ME185198 quite useful.
From a newsgroup post: "When this happened to me, not too long ago, it was that my registry was full. Check your registry; see if it met its maximum space”.

See ME184205 for additional information on this problem.
There are several conditions when this event can occur. See the links below for information about event 1000 and user profiles.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...