Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1521 Source: Userenv

Source
Level
Description
Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator.

DETAIL - Windows cannot find the network path. Verify that the network path is correct and the destination computer is not busy or turned off. If Windows still cannot find the network path, contact your network administrator.
Comments
 
Detail: Access is denied - See the comments for Error code 5.
This error was repeatedly reported for one of our users with a roaming profile each time when he was logging in into our terminal server. Investigation of the problem showed that this user had an incorrect "Terminal Services Profile" path. Instead of two slashes before a server name there was only one. This caused the system not to look for a profile on a network server, but on a local HDD. When an appropriate directory was not found, the system was attempting to create one. Because our users are forbidden to create files and folders in a root directory, this resulted in an "Access Denied" message seen in a File Monitor and a temporary profile for a user being created.
In one case on Windows Server 2003 R2 SP1, this was due to disconnecting a domain controller from the network (to simulate loss of connection) and then logging in with an account that had a roaming profile. The profile path was configured as a Dfs path and no Dfs replica for it existed on this server. A Dfs replica for the profiles share was added for this server and this event stopped appearing.
As per Microsoft: "This problem occurs if the following conditions are true:
1.You have installed the redirector software update ME885250 or a later version of the redirector software update. Update ME885250 is described in Microsoft security bulletin MS05-11.
2.The following flag is enabled on the users profile share of the Profile server:
SHI1005_FLAGS_ALLOW_NAMESPACE_CACHING"
See ME896427 for a hotfix applicable to Microsoft Windows XP.
This error occurred when the “Offline caching” option was turn on in the user profile share, and thus corrupting the user profiles. After the “offline caching” was turned off and the user profiles were recreated, this problem disappeared.


As per Microsoft: "This problem may occur if you use NetBIOS over TCP/IP (NetBT) to connect to your network, and you have a roaming user profile". See ME831651 for a hotfix.
I had this error due to a wrongly configured profile path for Terminal Services 2003. Correct the UNC path and the error should go away.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...