Event ID 1000 Userenv

  • Thread starter Thread starter Richard
  • Start date Start date
R

Richard

I have a user that gets this error a number of times in
the evening and eventually his acount gets locked out. I
tried removing the machine account from the domain and
then adding it back in. This seems to have gotten rid of
a number of system errors he was getting but now he is
getting this application error. I've been trouble
shooting this for a few days now and I am not sure where
to go next. The client OS is W2K Pro sp4. It is not
practical to rebuild the machine at this time. Any help
would be greatly appreciated.

(e-mail address removed)
 
In Richard <[email protected]> posted a question
Then Kevin replied below:
: I have a user that gets this error a number of times in
: the evening and eventually his acount gets locked out. I
: tried removing the machine account from the domain and
: then adding it back in. This seems to have gotten rid of
: a number of system errors he was getting but now he is
: getting this application error. I've been trouble
: shooting this for a few days now and I am not sure where
: to go next. The client OS is W2K Pro sp4. It is not
: practical to rebuild the machine at this time. Any help
: would be greatly appreciated.
:
: (e-mail address removed)

You would need to post the actual error from your log. There are quite a few
Userenv errors and it depends on the actual error as what you do to fix it.
 
Thanks Kevin

Here is the message from the event log:

Windows cannot determine the user or computer name.
Return value (1326). The Event ID is 1000 and the User is
System and the Source is Userenv. If you need more info
let me know, thanks.
 
In Richard <[email protected]> posted a question
Then Kevin replied below:
: Thanks Kevin
:
: Here is the message from the event log:
:
: Windows cannot determine the user or computer name.
: Return value (1326). The Event ID is 1000 and the User is
: System and the Source is Userenv. If you need more info
: let me know, thanks.
:
:
You said you removed remove the machine account and adding it back in, how
did you do that?

The correct way was to do it is, from the machine by disjoining the machine
from the domain and joining it to a workgroup. Then delete the machine
account in ADU&C then rejoin the machine to the domain letting the machine
create the account when you join it to the domain.
Was this the way you did it?
 
In Richard <[email protected]> posted a question
Then Kevin replied below:
: Yes, exactly.
:: -----Original Message-----
:: In :: Richard <[email protected]> posted a question
:: Then Kevin replied below:
::: Thanks Kevin
:::
::: Here is the message from the event log:
:::
::: Windows cannot determine the user or computer name.
::: Return value (1326). The Event ID is 1000 and the User is
::: System and the Source is Userenv. If you need more info
::: let me know, thanks.
:::

I've search every where for this code (1326) and I'm unable to find it.

You might try posting this in the Active Directory group to see if someone
has seen this one. You state his user account gets locked out?
When the user logs on to the machine are they logging on with a local
machine account or the domain account if their account is getting locked out
then there is a password syncronization problem.
Any info you can give on this might help.
 
In Richard <[email protected]> posted a question
Then Kevin replied below:
: Go to eventid.net, they have lots of information which I
: have tried as well.
I've been there it does not have this error code, if you have been there you
know it, too.
I don't have all the answers and this code 1326 is a new one unless you can
look through your event log and come up with more events that can give me a
hint, You have tried what I would have been able to suggest.
But I am going to take a stab at it again. There is a service or a task
scheduled on the machine, using an incorrect password. Probably set up by
the user and he changed his password. Or maybe even set up using the local
account on the machine.
Here is what you can do you need to enable security auditing for failures
event in the domain polcy and check the machine event security log for
failures. You can do this in the local policy but if it is disabled in the
domain policy when the policies are refreshed the auditing will stop.
 
In
Richard said:
Go to eventid.net, they have lots of information which I
have tried as well.
Click to expand...

Eventid.net gives EventID info, not error code information, which is what
1236 is.

My initial feeling is that you are using your ISP's DNS address whenever I
see an EventID 1000 with Source of Userenv. Can you post an *unedited*
ipconfig /all of this client please? THat will give us a start in diagnosing
this error.

Thanks


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Back
Top