We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now


Windows Server keeps rebooting

Medium Priority
Last Modified: 2012-05-06

Our Windows Server keeps rebooting usually at least once a day, usually around 8:00am to 9:00am and I have no idea why. Upon logging in to it again, I get the shutdown event tracker asking why the computer shut down unexpectedly - so I suspect that it may be getting a blue screen.

The server is a domain controller and Exchange 2007 server (among other roles).

I have looked in the Scheduled Tasks to see if there is anything around that time that may be causing it to crash or reboot, and found nothing. I have looked in the event viewer and found nothing of interest, although there does seem to be a few particular events that are always the last recorded events before it happens, albeit five to ten minutes beforehand.

The last recorded event in the System event log before each crash/reboot is an entry logged by the Service Control Manager and the description is either "The WinHTTP Web Proxy Auto-Discovery Service service entered the running state." or "The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state." (both of these have event IDs 7036) These give me no clue whatsoever because these events occur at plenty of other times throughout the night and day.

In the Application event log, I also find no clues. The last recorded event before each time differs. One time the last recorded event is just our spam blocker logging the fact that it blocked a spam message destined to a particular recipient. Two times the last recorded Application event is from MSExchange ActiveSync, event ID 1040, the description of which begins with "The average of the most recent [317] heartbeat intervals used by clients is less than or equal to [540].....". Another time the last recorded event is from MSExchange ADAccess, event ID 2080, the description for this one begins with "Process MAD.EXE (PID=4848). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
 (Server name | Roles | Enabled | ..."

I've got no idea what's going on.
Watch Question

Top Expert 2007

1) RUn DCDIAG and netdiag in verbose mode to text files

2) Run Exchange BPA ( best practices analyzer )Also Baselin analyzer

8-9 AM is the busiest time for logins, so maybe it is related to that also.

How are resouces on the server ( RAM, CPU etc )
Have you run perfmon in log mode ?

I hope this helps !
1.  Verify system is getting power from stable source
         A.  Connect primary power supply to a UPS.
         B.  Connect redundant power supply (if equipped) directly to receptacle on a separate circuit
2.  Test UPS battery
3.  Look for mini dumps from around the times of the crashes (%SystemRoot%\Minidump)
         A.  Look for full dumps if you have set them up (%SystemRoot%\MEMORY.DMP)

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

In Addition to the above advises, try to disable ASR (Automated System Restart). at least Auto restart might prevented and you might be able to see real time occurence of teh event.



Actually, it just so happens that the UPS has started beeping and the replace battery light is lit up now. I'm going to plug it straight into the wall and see if it keeps happening.


It turns out it was just the UPS. Odd that it would shut off the power just because the battery is dying, when it's still connected to the mains.


I feel so dumb right now :)
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.