Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 7711
  • Last Modified:

Shutdown/Restart : Enter a reason to continue

Hi, just wondering, is there anywhere i can view what's been put into the reasons for restarting/shutting down a Windows 2003 Server? I looked in the Event Viewer and couldn't find any logs.
0
mortar
Asked:
mortar
  • 5
  • 4
  • 4
1 Solution
 
Nirmal SharmaSolution ArchitectCommented:
After how many hours does it restart/shutdown? Any duration or timing ?..
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
Look in the System log for Source USER32, Event ID 1074
0
 
Nirmal SharmaSolution ArchitectCommented:
Leew why specifically for this event only?
0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 
Lee W, MVPTechnology and Business Process AdvisorCommented:
When you shut down a Windows 2003 server, it prompts you for a reason.  The reason and shutdown is stored in this entry - check your event log, you'll see what I mean.
0
 
Nirmal SharmaSolution ArchitectCommented:
He has already mentioned that he does not see any Event Log? You mean to say he didn't check in System Log and have checked all other?
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
I mean he didn't find the right entry - I just checked my system as I did this last night and that's the event log message that was generated.
0
 
Nirmal SharmaSolution ArchitectCommented:
Ok leew :-)
0
 
mortarAuthor Commented:
Hi leew.

I found 8 entries that seem to be there alright.  
The only things I can see basically are 'reason codes' of 0x30006 and 'shutdown type' : restart.

So for instance, recently I shutdown the server and gave the reason "Shutdown to reinstall new NIC".  Shouldn't I be able to see that in there somewhere?
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
Copy and paste your entry.  Here's mine:

The process winlogon.exe has initiated the restart of computer SERVER on behalf of user domain\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: restart
 Comment: Server unresponsive

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 
mortarAuthor Commented:
The process winlogon.exe has initiated the restart of computer ATSERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x30006
 Shutdown Type: restart
 Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
-------------------

Sorry my bad.. they seem to be events initiated by the computer, I missed the RPC error... They're all pretty much the same so it appears for some reason my entries are not being logged?
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
Strange... If possibly, can you shut down now and restart?  For me, "Comment: Server unresponsive" is what I entered.
0
 
mortarAuthor Commented:
The process winlogon.exe has initiated the restart of computer ATSERVER on behalf of user ATSERVER\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: restart
 Comment: this is to test that the logging works


mmm Seems to work alright now..  I cleared all the logs before I restarted, and I also restarted using the shutdown /i command which pops up a window allowing you to shut down multiple pcs and enter reasons etc.

So do a local shutdown tonight (the way I normally do) and see if the reason is logged now ;)
Will keep you posted!
0
 
mortarAuthor Commented:
Checked again.. works fine now, maybe it was just a corrupted log or something that was stuffing it up.. Thanks for all your help!
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 5
  • 4
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now