mortar
asked on
Shutdown/Restart : Enter a reason to continue
Hi, just wondering, is there anywhere i can view what's been put into the reasons for restarting/shutting down a Windows 2003 Server? I looked in the Event Viewer and couldn't find any logs.
Nirmal Sharma
After how many hours does it restart/shutdown? Any duration or timing ?..
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Leew why specifically for this event only?
When you shut down a Windows 2003 server, it prompts you for a reason. The reason and shutdown is stored in this entry - check your event log, you'll see what I mean.
He has already mentioned that he does not see any Event Log? You mean to say he didn't check in System Log and have checked all other?
I mean he didn't find the right entry - I just checked my system as I did this last night and that's the event log message that was generated.
Ok leew :-)
ASKER
Hi leew.
I found 8 entries that seem to be there alright.
The only things I can see basically are 'reason codes' of 0x30006 and 'shutdown type' : restart.
So for instance, recently I shutdown the server and gave the reason "Shutdown to reinstall new NIC". Shouldn't I be able to see that in there somewhere?
I found 8 entries that seem to be there alright.
The only things I can see basically are 'reason codes' of 0x30006 and 'shutdown type' : restart.
So for instance, recently I shutdown the server and gave the reason "Shutdown to reinstall new NIC". Shouldn't I be able to see that in there somewhere?
Copy and paste your entry. Here's mine:
The process winlogon.exe has initiated the restart of computer SERVER on behalf of user domain\Administrator for the following reason: Other (Planned)
Reason Code: 0x85000000
Shutdown Type: restart
Comment: Server unresponsive
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
The process winlogon.exe has initiated the restart of computer SERVER on behalf of user domain\Administrator for the following reason: Other (Planned)
Reason Code: 0x85000000
Shutdown Type: restart
Comment: Server unresponsive
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
ASKER
The process winlogon.exe has initiated the restart of computer ATSERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x30006
Shutdown Type: restart
Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
-------------------
Sorry my bad.. they seem to be events initiated by the computer, I missed the RPC error... They're all pretty much the same so it appears for some reason my entries are not being logged?
Reason Code: 0x30006
Shutdown Type: restart
Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
-------------------
Sorry my bad.. they seem to be events initiated by the computer, I missed the RPC error... They're all pretty much the same so it appears for some reason my entries are not being logged?
Strange... If possibly, can you shut down now and restart? For me, "Comment: Server unresponsive" is what I entered.
ASKER
The process winlogon.exe has initiated the restart of computer ATSERVER on behalf of user ATSERVER\Administrator for the following reason: Other (Planned)
Reason Code: 0x85000000
Shutdown Type: restart
Comment: this is to test that the logging works
mmm Seems to work alright now.. I cleared all the logs before I restarted, and I also restarted using the shutdown /i command which pops up a window allowing you to shut down multiple pcs and enter reasons etc.
So do a local shutdown tonight (the way I normally do) and see if the reason is logged now ;)
Will keep you posted!
Reason Code: 0x85000000
Shutdown Type: restart
Comment: this is to test that the logging works
mmm Seems to work alright now.. I cleared all the logs before I restarted, and I also restarted using the shutdown /i command which pops up a window allowing you to shut down multiple pcs and enter reasons etc.
So do a local shutdown tonight (the way I normally do) and see if the reason is logged now ;)
Will keep you posted!
ASKER
Checked again.. works fine now, maybe it was just a corrupted log or something that was stuffing it up.. Thanks for all your help!