Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1505 Source: Userenv

Windows cannot load the user's profile but has logged you on with the default profile for the system.

DETAIL - <error message>.
The ME947215 helped me to resolve the issue (to restore working profile for the user) method #1.
I found out that someone had deleted the "Default User" folder out of the "Documents and Settings" folder, so when a new user tried to login for the first time this error message appeared. I just copied the folder from another computer and the problem was solved.
I had this problem with a user who had changed security permissions on his folder under Documents and Settings. He had removed everything bar his domain account, which caused problems for Windows.
Re-applying the normal System settings fixed the problem.
You experience this problem if many users are logged on to the terminal server. See ME935649 to resolve it.
I had the same error message with local and domain users. The problem was that the user had deleted the default folder in the documents and settings folder. Replacing the folder from a similar PC solved the problem. Be sure to hide the folder and remove the users admin rights so they can't delete the folder again.

It appears this event is related to EventID 1508 from source Userenv. Look up EventID 1508, in my case once the “.dat” files were deleted and the system was restarted this error went away.
From a newsgroup post: "Boot into Safe Mode and log on using the Administrator account. Rename the "UsrClass.dat" file to "UsrClass.old" found in the following folder: "C:\Documents and Settings\<user account>\local settings\application data\Microsoft\windows", where <user account> is the name of the account which has the problem. Restart your computer in Normal Mode and then log on the computer using your account".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.