Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1004 Source: Microsoft-Windows-TerminalServices

Level
Description
The terminal server cannot issue a client license. It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at the client's computer.
Comments
 
First make sure the server licensing mode matches the licenses you have purchased/installed in the TS Licensing Manager console. I received this because there was already a Win2003 TS Licensing server that was automatically detected in AD and the 2008 Terminal Server was trying to obtain TS CALs from the W2003 Licensing server. I manually configured the 2008 server to obtain TS Licenses from a 2008 Licensing server and the issue was resolved.
In one case, this event is misleading because the license is successfully issued. Therefore, this event may confuse administrators and cause unnecessary troubleshooting efforts. See ME957068 for a hotfix applicable to Windows Server 2008.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...