Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator.
DETAIL - Windows cannot find the network path. Verify that the network path is correct and the destination computer is not busy or turned off. If Windows still cannot find the network path, contact your network administrator.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a roaming profile?
When does one get an access denied message?
What is the role of Userenv?
Detail: Access is denied - See the comments for Error code 5.
This error was repeatedly reported for one of our users with a roaming profile each time when he was logging in into our terminal server. Investigation of the problem showed that this user had an incorrect "Terminal Services Profile" path. Instead of two slashes before a server name there was only one. This caused the system not to look for a profile on a network server, but on a local HDD. When an appropriate directory was not found, the system was attempting to create one. Because our users are forbidden to create files and folders in a root directory, this resulted in an "Access Denied" message seen in a File Monitor and a temporary profile for a user being created.
In one case on Windows Server 2003 R2 SP1, this was due to disconnecting a domain controller from the network (to simulate loss of connection) and then logging in with an account that had a roaming profile. The profile path was configured as a Dfs path and no Dfs replica for it existed on this server. A Dfs replica for the profiles share was added for this server and this event stopped appearing.
As per Microsoft: "This problem occurs if the following conditions are true:
1.You have installed the redirector software update ME885250 or a later version of the redirector software update. Update ME885250 is described in Microsoft security bulletin MS05-11.
2.The following flag is enabled on the users profile share of the Profile server:
See ME896427 for a hotfix applicable to Microsoft Windows XP.
This error occurred when the “Offline caching” option was turn on in the user profile share, and thus corrupting the user profiles. After the “offline caching” was turned off and the user profiles were recreated, this problem disappeared.
As per Microsoft: "This problem may occur if you use NetBIOS over TCP/IP (NetBT) to connect to your network, and you have a roaming user profile". See ME831651 for a hotfix.
Peter Van Gils
I had this error due to a wrongly configured profile path for Terminal Services 2003. Correct the UNC path and the error should go away.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated