Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1525 Source: Userenv

Source
Level
Description
Windows has detected that Offline Caching is enabled on the Roaming Profile share - to avoid potential profile corruption, Offline Caching must be disabled on shares where roaming user profiles are stored.
Comments
 
See EV100154 for details about how to fix this.
As per Microsoft: "This event may occur if the following conditions exist:
1.A Windows XP-based computer is member of a Microsoft Windows NT 4.0-based domain or of a Microsoft Windows 2000-based domain.
2.You put the roaming profile of a domain user on a Windows NT 4.0-based server.
3.You log on as this user from a Windows XP-based computer". See ME325838 for more information about this event.
To disable offline caching on Windows 2003 Server, right click on the share and choose properties. On the Sharing tab, select the appropriate share from the share name drop down box. Next, click the Offline Settings box. On the Offline Settings box, choose “Files or programs from the share will not be available offline”. Click OK.
As per Microsoft: "If offline folder access is available for a user's roaming profile share, synchronization problems might occur because both offline folders and roaming profiles try to synchronize the files in the user's profile". See MSW2KDB for more details.
See ME287566. Possibly related to level2 oplocks = yes in samba


This warning only shows up in the client's event log if the following 2 conditions are met:
1) You log on to a w2k domain using an XP client and
2) You have a roaming user account.
To resolve this problem go to the w2k server on which you keep your shared roaming profile directory. Right click on the share and choose the Sharing option from the roll down window. In the dialogue box click on the "Caching" button. Remove the check from the box next to the "Allow caching of files in this shared folder" then click ok and ok again to exit.
A Windows XP Professional-based computer that is joined to a domain with folder redirection enabled (e.g. redirection of "My Documents" for each domain user to minimize the size of roaming user profiles), may show this event. Following the steps described in the ME304624 article to enable the "Do not automatically make redirected folders available offline" Group Policy setting on the Domain Controller, will resolve the problem.
If you do not disable the cache option for Offline Files on a user profile share, the profile will become unstable, as both the Offline Files and roaming profile attempt to synchronize the files in the profile. The cache option is SMB share based. If you enable the cache option on a share, and roaming profiles are below that share, Offline Files caches files in the profile.
NOTE: Whenever possible, store roaming profiles and offline-enabled shares on different servers.

To resolve the problem:
Create a separate share for user profiles and disable the cache option on the new share by opening a CMD prompt and typing:

net share \\Server\Sharename /cache:no

You can use Windows Explorer to disable the cache by right-clicking the shared folder and press Properties. On the Sharing tab, press the Caching button and clear the Allow caching of files in this folder box.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...