Services shut off with no warning, stops file sharing

event logs
eventlogs.zip

Are the workstation and Server services also shutting down? If not, it sounds like you have a browser conflict. I am currently rebuilding my main desktop for the administrtor, so I couldn't open up the zip file due to lack of a zip utility.

I'll bet you have event 8030 and 8021 that say something like, "xxxcomputer thinks it is the domain master browser. The browser service has been stopped and an election has been forced."

yeah workstation and server have also been known to shut down.

this server has a odd recent history (i was away)
the previous tech removed it from the domain forgot the password so we sent it into a password recovery shop.
once we got the password put it back on a domain, now its just a stand alone server. so i don't know if its creating a weird conflict.

i'll check for the events tomorow and update.

So, many things may apply:

You may have this server tombstoned in AD, depending on how long it was in the "password recovery" shop. So, you may have AD metadata.

You may have AD Sites and Services told to replicate to this server, even though it is not just a "member server". So, there is probably FRS metadata.

You might also have DNS metadata of SRV records for this server being an AD server.

So what do you recommend doing?

this has also happened to another server (2) recently.

at the start of it, i thought it was just a problem with RPC an unable to RDP to the server (https://www.experts-exchange.com/questions/23875203/can't-restart-RPC-services-in-services-can't-rdp-'The-RPC-server-is-unavailable-'.html)

Thanks kg69:

I ran a virus scan on it today, looks clean

i will follow the procedure tonight as well as run the checkdsk hopefuly that fixes those problems.

do you feel that once i run (http://windowsitpro.com/article/articleid/80294/jsi-tip-7751-winmgmt-could-not-initialize-the-core-parts.html) the system will act normally?

- run http://windowsitpro.com/article/articleid/80294/jsi-tip-7751-winmgmt-could-not-initialize-the-core-parts.html

Commands i ran

Generated following event errors

- run chkdsk

applied 234474_ENU_i386 HF, this was from http://support.microsoft.com/kb/910666

services appear to be up on start up

received the following errors

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1090
Date:            11/5/2008
Time:            12:26:16 AM
User:            NT AUTHORITY\SYSTEM
Computer:      CBIZ_QB
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session status. An attempt to connect to WMI failed. No more RSoP logging will be done for this application of policy.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1090
Date:            11/5/2008
Time:            12:25:17 AM
User:            NT AUTHORITY\SYSTEM
Computer:      CBIZ_QB
Description:
Windows couldn't log the RSoP (Resultant Set of Policies) session status. An attempt to connect to WMI failed. No more RSoP logging will be done for this application of policy.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:      Error
Event Source:      WinMgmt
Event Category:      None
Event ID:      28
Date:            11/5/2008
Time:            12:25:17 AM
User:            N/A
Computer:      CBIZ_QB
Description:
WinMgmt could not initialize the core parts.  This could be due to a badly installed version of WinMgmt, WinMgmt repository upgrade failure, insufficient disk space or insufficient memory.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

i will monitor this server for the next day, hopefully this resolved the problem

but this was never a domain controller, it was just a server part of a domain.

Thanks ChiefIT

scheduled for after production tonight