Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1219 Source: Userenv

Login rejected for <domain name>\<user name>. Unable to obtain Terminal Server User Configuration. Error: <error description>.
The TCP/IP NetBIOS Helper service was not started on the server. After starting it, the server was fine.
I experienced this problem on Windows Server 2003 SP1. The server is running 3COM's TFTP service, which was attempting to send boot information to one of our Polycom phones. Stopping & restarting the TFTP service resolved this issue and allowed clients to logon temporarily. The TFTP software was replaced as a permanent solution.
I had this problem on a Windows 2003 Server SP1 (patched up to date). The problem was caused by the DNS configuration. The DNS server for AD that the server was trying to reach was offline and no other servers had been configured. Hence, large delays (over the 15 second limit) in resolving the names of the DCs occurred. Troubleshooting this by manually adding additional DNS servers solved the problem immediately.
ME815266 helped me to resolve this problem.
See ME331627 to see when this event occurs.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.