Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1504 Source: Userenv

Windows cannot update your roaming profile. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator.

DETAIL - <detail message>
I found that my server was not able to contact my domain controller for some of the userís profiles. The problem appeared because the NIC team was damaged and after disconnecting and reconnecting the team, everything started flowing again.
We are using Windows Server 2003 Standard Edition and I tried the potential repairs stated below that were relevant to our configurations. I found our problem was due to cached login information. I performed the following steps to remediate the problem:

1. Open the Control Panel.
2. Go to Stored User Names and Passwords.
3. Delete any Cached user names.

Once I did this, everything began to click (although the information provided below is helpful in clearing up best practices when configuring roaming profiles).
See ME911805 for information about this event.
I was receiving this error message and my roaming profiles were failing to upload to the server. It turned out this was due to insufficient permissions on the "route" to the user profile folder. I changed all the parent folders so that "Everyone" had the "Traverse Folder / Execute File", "Read Attributes" and "Read Extended Attributes" permissions on "This folder only" for each of the folders in the user profile path. Users are now able to upload their roaming profiles, and the event is gone.
As per Microsoft: "This issue may occur if the NetApp Filer has timing problems and returns incorrect SMB status codes. To resolve this issue, update the NetApp Filer to ONTAP Release 6.4.1D16". See ME826379 for more details.

Happens when connectivity is lost to the domain controller or your PC cannot communicate to the domain controller. This can be caused by lose of network connectivity or slowness of network, corrupt profile, or your PC creating a temporary profile when you first login because your roaming profile could not be pulled down from the server. To fix check connectivity, rebuild roaming profile and delete locally cached copy or profile on the PC.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.