Event ID - 1000

Event Id	1000
Source	Microsoft-Windows-TerminalServices-SessionBroker
Description	The TS Session Broker failed to delete all the log files in the "%SystemRoot%\System32\tssesdir\" directory. The error code was %1.
Event Information	According to Microsoft : Cause : This event is logged when the TS Session Broker failed to delete all the log files in the "%SystemRoot%\System32\tssesdir\" directory. Resolution : Close TS Session Broker log files or remove read-only attribute To resolve this issue, do one or both of the following: Close any TS Session Broker log files that are open. Ensure that the TS Session Broker log files are not set to read-only. To perform these tasks, refer to the following sections. The TS Session Broker log files are located in the %systemroot%\system32\tssesdir folder (where %systemroot% is the folder in which the operating system is installed, which is, by default, c:\windows). Close any TS Session Broker log files that are open If you have any of the log files open, close the files and then start the Terminal Services Session Broker service. To start the Terminal Services Session Broker service, see the section titled "Start the Terminal Services Session Broker service." Ensure that the TS Session Broker log files are not set to read-only If the log files are not open, or if the problem still occurs after you close the files, ensure that the log files are not set to read-only and then start the Terminal Services Session Broker service. To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority. To check the read-only attribute for the log files: On the TS Session Broker server, click Start, click Run, type %systemroot%\system32\tssesdir and then click OK. For each file, do the following: a.Right-click the file, and then click Properties. b.On the General tab, ensure that the Read-only check box is cleared, and then click OK. After you check the read-only attribute of each log file, start the Terminal Services Session Broker service. Start the Terminal Services Session Broker service To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority. To start the Terminal Services Session Broker service: On the TS Session Broker server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. In the Services pane, right-click Terminal Services Session Broker, and then click Start. Confirm that the Status column for the Terminal Services Session Broker service displays Started. Verify :To verify that the TS Session Broker server is available, ensure that the Terminal Services Session Broker service is running. To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority. To check the Terminal Services Session Broker service: On the TS Session Broker server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. In the Services pane, locate Terminal Services Session Broker. Confirm that the Status column for the Terminal Services Session Broker service displays Started.
Reference Links	Event ID 1000 from Source Microsoft-Windows-TerminalServices-SessionBroker

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught