2008 R2 Servers sometimes log unexpected shutdown although shutdown was clean

this was a common issue with certain chipsets when Win 7 had no service pack installed.  the reset was usually triggered by the motherboard and the occasional app or service.  make sure under Adv System Settings\Startup & Recovery Settings, untick the Automatic restart box, to see what happens next time this triggers, you may get to see an error message (or better get a dump file stored in C:\Windows\Minidump).

Assuming you have SP1 installed, do these systems have any common hardware (all the same desktop model) or (all the same server hardware)??

also watch some patches you might be installing, those can also trigger restarts, though they should not really be unexpected.

lainix, the restart is ok. If it were not, on the next reboot, we would see something like "windows failed to start" - we don't. This is a bug.
This is 2008 R2 SP1 and win7 SP1. There are no blue screens/minidumps but only clean reported as unclean.
Please only continue if you had the same problem, not a different one.

I have come across servers that do this. The issue was usually a service that failed to shut down in time. Sometimes they would record an event in the log during shutdown, sometimes not. Have you seen anything else unusual in the logs.

A few times it was anti-virus, but not always. Since you said it happens on the windows 7 machines, it isn't as hard to troubleshoot. Start with safe mode and see if you can reproduce the problem. Then go from there.

Also as the previous expert said, it can happen because of certain chipsets. So make sure you have latest drivers as well.

McKnife,

1) First of all enable boot logging (it will collect all boot logs in installed directory).
2) Check if the pagefile set to clean during the shutdown (this may cause unexpected restart as services may be not stopped and pagefile cleared)
3) Check the even logs for errors ( just after the shutdown initiated and post them here)
4) make sure RAM is in good condition.
5) There is no BAD sectors in the disk ( you can check this in the event log as well)

Start with first 2 points.

Pradeep did you have the same problem? 1-5 all ok, 2: no, not set to clean. Boot logs reveal nothing.
TBone2k: The event log is clean. The drivers are the latest. Will try safe mode for diagnosis.

Both: be aware that this is abnormal. With shutdown failures, you would expect not only to see event 6008 (we see it, yes), but also this (which we don't see):

Yes but in my case that was Disk having BAD sector.

Along with the safe mode can you try the clean boot once. This will make sure that this is something related to the application.

Thanks for the feedback. This has happened on several systems, so bad memory/disk is unlikely.

To both: did you really experience the same: clean shutdown, clean boot (without seeing the screenshot I posted) but nevertheless 6008?

I have a server 2008R2 which does that. I have event ID 6008, but I never get the screen like you show above. One thing that seems to be related is an event 1074. Check and see if this message changes between clean restarts and those with an error.

I also found a similar discussion here:
http://www.eventid.net/display.asp?eventid=41&eventno=10602&source=Kernel-Power&phase=1 (different event ID, but I read where it solved the problem you describe)

Ok, I will experiment with the intel-c-state setting.
I am afraid I will suspend this question because my vacation starts. Will be back on it in 2 weeks or so.

Generally it takes longer than two weeks for any sort of auto-cleanup. I would see a warning before anythign happens and will let them know if they miss your mention of going on vacation.

Okay, back from vacation, new projects squeezing in. Will have the time to experiment with one of those candidates in the week starting at the 23rd - no sooner, sorry.

Happened again with a machine that was setup brand new. Seems to begin after installing kaspersky (KES 8.1), but I might be mistaken as we installed several software before rebooting. KES is up to date so thousands of users would experience that. Will carry on isolating the problem.

I've requested that this question be deleted for the following reason:

The question has either no comments or not enough useful information to be called an "answer".

Too bad I didn't find the time to look further into it. So LeeTutor, if you think you need to clean, please do. I would come back, but I don't know when, sorry about that.

I would not like to see this question deleted. Instead, please select my last comment https://www.experts-exchange.com/questions/28219906/2008-R2-Servers-sometimes-log-unexpected-shutdown-although-shutdown-was-clean.html?anchorAnswerId=39582416#a39582416 as solution, so others may find this helpful.

be careful with Dot Net stuff (final v4.5 has just been released), i typically have about 12 or more of various Dot Net versions still to be authorised on my WSUS server.  if you are having this happen on a non-server OS as well, i think you may have to check your group policies and systems settings, as you may have other underlying issues which are causing you to have this issue on different platforms?

Win 7 & 2008 server have all Dot Net's up to 3.5.1 pre-installed, but still have a lot of patches, plus you then have to add in the Dot Net 4 client side and full install.  I have found 4.5 to be of some help with QPulse and SQL issues.

If that is the case, then please mark your answer as the correct solution. As long as no other experts object, it will become the accepted answer.

Can you enable shutdown tracker as given in below link (select your scenario)

http://technet.microsoft.com/en-us/library/cc770960.aspx


also look into this blog once:

http://social.technet.microsoft.com/Forums/windowsserver/en-US/d10b8ba4-5b1a-440f-bc3c-2e8d02d10896/unexpected-shutdown-but-a-soft-reboot-was-performed?forum=winservergen

@Tbone2k
"If that is the case, then please mark your answer as the correct solution. As long as no other experts object, it will become the accepted answer." - not quite so. As closure was already in progress, I first had to object to closure, what I did. I technically could not select my own solution due to ongoing closure.
Pradeep, it has to do with windows' internals, I am not willing to change that right now, because that would need time, so I try to close the question.

I wasn't talking about what you could have done *then*. I am talking about what you can do *now*. If you still can't accept your own answer at this point, please send/update request for attention and tell them what you want to do and an admin will look after you.