Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1500 Source: Userenv

Source
Level
Description
Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, or that your network is functioning correctly. If this problem persists, contact your network administrator.

DETAIL - Access is denied.
Comments
 
I had this issue with XP, and found the issue to be Permissions for the Documents and Settings folder.

It had local Administrators, the actual Admin account, and a user who for some reason had full access to the folder.

I removed the user, removed admin (as its in Administrators group), and then added Everyone, Users, and Power Users with Read/Execute, List Folder, and Read permissions.

This then worked fine after a reboot.
I had this issue with XP, and found the issue to be Permissions for the Documents and Settings folder.

It had local Administrators, the actual Admin account, and a user who for some reason had full access to the folder.

I removed the user, removed admin (as its in Administrators group), and then added Everyone, Users, and Power Users with Read/Execute, List Folder, and Read permissions.

This then worked fine after a reboot.
The detail part of the event can contain different error messages. The troubleshooting should be approached based on that message as the solution for one would not apply to another.

Common errors:
- Access is denied - See Error code 5
- Insufficient system resources exist to complete the requested service - This may indicate a bug in one of the applications running on this system, a bug that causes the resources to depleat. These resources could be physical memory, hard disk, or certain type of programming resources used by the operating system. For example, if Windows only allows a certain number of processes to run for a specific application, you might get this message when the application is trying to initiate another process, even though there is sufficient memory available. A reboot may release the used resources, but the problem may reoccur. The admin should try to update the operating system and the applications running on it. See also Error code 1450.
- Incorrect function - See Error code 1
In our case the problem was a corrupted default user profile. After we recreated it, there were no more 1500 errors in the log.
I got this error on a Windows 2003 Terminal Server with terminal server profile and app data redirection. It was because there was no default user profile. I copied one from another Windows 2003 Server and it fixed my problem.


W2003 TS 45 Users - In my case only some users had problems logging in and this error messege was recorded. There was a group policy that is applied to these users. I moved the problem users to the "No group policy" group, gave admin rights and the login worked fine. After that I logged off the user and moved it into the old group, removed admin rights and all the problems were fixed.
This issue may occur if the user profile was manually deleted by using the command prompt or by using Windows Explorer. See ME947215 for information on solving this problem.
From a newsgroup post: "While many administrative changes are instantaneous in XP, there are some things that still require a complete log off (not switch users) or restart for them to be updated properly. Many things that are user account related fall into this category. Example: Credentials (name/passwords etc), some policies, and permissions are not updated until the next logon. User accounts are not wholly formed until their first logon occurs.
"Username.anothername" indicates that there are remnants of an old account with the same username hanging around. The newer account gets the ".anothername" added to separate it from the other. Example: reinstalling Windows on top of an existing Windows (different than running a repair install) often turns up "username.windows" accounts. Name new Administrator account something other than Administrator to have it show up without ".computername" tagged onto the end. It is a good idea to let the default system created Administrator account fade into the background. Keep it in reserve for emergencies. Create an "everyday" user in the Administrator group to manage the system".

As per Microsoft: "UPHClean monitors the computer while Windows is unloading user profiles and forces resources that are open to close. Therefore, the computer can unload and reconcile user profiles". See ME837115 to get the Microsoft User Profile Hive Cleanup Service (UPHClean).

See MSW2KDB for additional information on this event.
This problem appeared on a Windows 2003 Terminal server after applying SP1. More than 30 users could login successfully but other users got this error and an EventID 1508 from source Userenv. After I installed ME898060, the errors disappeared.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...