Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1218 Source: Winlogon

Source
Level
Description
Failed to load Terminal Server Profile path. Note that the profile path must be less than 256 characters in length. User Name: <username> Domain: <Domain>
Comments
 
See ME887434 for information on resolving this problem.
1. Windows 2000 domain controllers running Terminal Services configured to use Remote Administration mode do not permit regular user logon, with the exception of two concurrent administrator accounts for server management. When a user attempts to connect to a Windows 2000-based domain controller running Terminal Services configured to use Remote Administration mode, the following error message is generated: You do not have access to logon to this Session.
2. Windows 2003 domain controllers running RDC do not permit regular user logon, with the exception of administrator accounts.
3. The user attempting to log on does not have sufficient permissions on the appropriate RDP-TCP connection. Modify the RDP-TCP permissions by using Terminal Services Configuration to grant the user or group the logon permission.
4. Terminal Services has a default connection security setting allows only administrators to log on. If the security attributes on a specified connection have not been set, the connection inherits these default security settings.
You must give permissions in Administrative Tools -> Terminal Services Configuration -> Connections -> Properties of ICA-tcp (if you have Citrix) and RDP-Tcp -> Permissions (User access/Guest access) to the needed user or group.
See the bugfix from Microsoft described in ME829109.
We were getting error 1525 (detected that offline caching is enabled on roaming profile share) and I opened the computer manager and disabled the caching for the share used for the user's profiles. Suddenly the log was flooded with even 1218's. Reenabled caching for the share, and it went back to error 1525.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...