Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: Userinit

Source
Level
Description
Windows could not execute <file name> due to the following error: The system cannot find the file specified.
Comments
 
We had a similar issue, where the error was coming up for one particular user. I had the user logon to another computer without any issues, indicating that this was not a user specific issue and was indeed related to the computer itself. Performed a GPResult which indicated that the problem computer was indeed pulling the correct policy. On a whim, I removed computer from domain and placed on workgroup, removed Computer from ADU&C. Re-added the computer back to domain, restarted, and this solved the issue.
In my case this was helpful:

The GpNetworkStartTimeoutPolicyValue policy timeout can be specified in the registry in two locations:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System

You can do this by adding a DWORD value of GpNetworkStartTimeoutPolicyValue with a number of seconds between 30 and 600. If you put for example, GpNetworkStartTimeoutPolicyValue value to 60 and it still doesn't work, you can increase it.
In one case on Windows Server 2003 R2 SP1, this problem was due to disconnecting a domain controller from the network (to simulate loss of connection) and then logging in with an account that had a roaming profile. The profile path was configured as a Dfs path and no Dfs replica for it existed on this server. A Dfs replica for the profiles share was added for this server and this event stopped appearing.
This problem can appear because of network errors that occur during script execution. A script may also be inaccessible because of file sharing violations. See T778459 for information on this issue.

See ME326152 and ME840669 for additional details on fixing this problem.
This event is happen also if you will add some programme to Logon script in GP and setting Run only allowed Windows application. As a example: in group policy in User Configuration -> Windows Settings -> Scripts -> Logon you will put fg c:\winnt\test.bat and  you have to remember that in User Configuration -> Administrative Tempaltes -> System Run only allowed Windows application you have to add test.bat. If not logon script will not run and in the event logs you will see this message.


To eliminate this event ensure that the full UNC path to the logon script is specified within the group policy that assigns the logon script. For example:\\domain name\sysvol\domain name\Policies\{GUID}\User\Scripts\Logon\logonscript.vbs
Since implementing this in our large Windows 2000 environment (17000 ws+) we have not had this problem occur.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...