Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Windows cannot load the user's profile but has logged you on with the default profile for the system.
DETAIL - <error message>.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of Userenv?
The ME947215 helped me to resolve the issue (to restore working profile for the user) method #1.
I found out that someone had deleted the "Default User" folder out of the "Documents and Settings" folder, so when a new user tried to login for the first time this error message appeared. I just copied the folder from another computer and the problem was solved.
I had this problem with a user who had changed security permissions on his folder under Documents and Settings. He had removed everything bar his domain account, which caused problems for Windows.
Re-applying the normal System settings fixed the problem.
You experience this problem if many users are logged on to the terminal server. See ME935649 to resolve it.
I had the same error message with local and domain users. The problem was that the user had deleted the default folder in the documents and settings folder. Replacing the folder from a similar PC solved the problem. Be sure to hide the folder and remove the users admin rights so they can't delete the folder again.
It appears this event is related to EventID 1508 from source Userenv. Look up EventID 1508, in my case once the “.dat” files were deleted and the system was restarted this error went away.
From a newsgroup post: "Boot into Safe Mode and log on using the Administrator account. Rename the "UsrClass.dat" file to "UsrClass.old" found in the following folder: "C:\Documents and Settings\<user account>\local settings\application data\Microsoft\windows", where <user account> is the name of the account which has the problem. Restart your computer in Normal Mode and then log on the computer using your account".
|Private comment: Subscribers only. See example of private comment|
|Links: EventID 1508 from source Userenv|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (2) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated