Shutdown/Restart : Enter a reason to continue

Hi, just wondering, is there anywhere i can view what's been put into the reasons for restarting/shutting down a Windows 2003 Server? I looked in the Event Viewer and couldn't find any logs.
LVL 4
mortarAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Nirmal SharmaSolution ArchitectCommented:
After how many hours does it restart/shutdown? Any duration or timing ?..
0
Lee W, MVPTechnology and Business Process AdvisorCommented:
Look in the System log for Source USER32, Event ID 1074
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Nirmal SharmaSolution ArchitectCommented:
Leew why specifically for this event only?
0
Cloud Class® Course: C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

Lee W, MVPTechnology and Business Process AdvisorCommented:
When you shut down a Windows 2003 server, it prompts you for a reason.  The reason and shutdown is stored in this entry - check your event log, you'll see what I mean.
0
Nirmal SharmaSolution ArchitectCommented:
He has already mentioned that he does not see any Event Log? You mean to say he didn't check in System Log and have checked all other?
0
Lee W, MVPTechnology and Business Process AdvisorCommented:
I mean he didn't find the right entry - I just checked my system as I did this last night and that's the event log message that was generated.
0
Nirmal SharmaSolution ArchitectCommented:
Ok leew :-)
0
mortarAuthor Commented:
Hi leew.

I found 8 entries that seem to be there alright.  
The only things I can see basically are 'reason codes' of 0x30006 and 'shutdown type' : restart.

So for instance, recently I shutdown the server and gave the reason "Shutdown to reinstall new NIC".  Shouldn't I be able to see that in there somewhere?
0
Lee W, MVPTechnology and Business Process AdvisorCommented:
Copy and paste your entry.  Here's mine:

The process winlogon.exe has initiated the restart of computer SERVER on behalf of user domain\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: restart
 Comment: Server unresponsive

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
mortarAuthor Commented:
The process winlogon.exe has initiated the restart of computer ATSERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x30006
 Shutdown Type: restart
 Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
-------------------

Sorry my bad.. they seem to be events initiated by the computer, I missed the RPC error... They're all pretty much the same so it appears for some reason my entries are not being logged?
0
Lee W, MVPTechnology and Business Process AdvisorCommented:
Strange... If possibly, can you shut down now and restart?  For me, "Comment: Server unresponsive" is what I entered.
0
mortarAuthor Commented:
The process winlogon.exe has initiated the restart of computer ATSERVER on behalf of user ATSERVER\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: restart
 Comment: this is to test that the logging works


mmm Seems to work alright now..  I cleared all the logs before I restarted, and I also restarted using the shutdown /i command which pops up a window allowing you to shut down multiple pcs and enter reasons etc.

So do a local shutdown tonight (the way I normally do) and see if the reason is logged now ;)
Will keep you posted!
0
mortarAuthor Commented:
Checked again.. works fine now, maybe it was just a corrupted log or something that was stuffing it up.. Thanks for all your help!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.