Windows Server keeps rebooting

Posted on 2009-02-09
Last Modified: 2012-05-06

Our Windows Server keeps rebooting usually at least once a day, usually around 8:00am to 9:00am and I have no idea why. Upon logging in to it again, I get the shutdown event tracker asking why the computer shut down unexpectedly - so I suspect that it may be getting a blue screen.

The server is a domain controller and Exchange 2007 server (among other roles).

I have looked in the Scheduled Tasks to see if there is anything around that time that may be causing it to crash or reboot, and found nothing. I have looked in the event viewer and found nothing of interest, although there does seem to be a few particular events that are always the last recorded events before it happens, albeit five to ten minutes beforehand.

The last recorded event in the System event log before each crash/reboot is an entry logged by the Service Control Manager and the description is either "The WinHTTP Web Proxy Auto-Discovery Service service entered the running state." or "The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state." (both of these have event IDs 7036) These give me no clue whatsoever because these events occur at plenty of other times throughout the night and day.

In the Application event log, I also find no clues. The last recorded event before each time differs. One time the last recorded event is just our spam blocker logging the fact that it blocked a spam message destined to a particular recipient. Two times the last recorded Application event is from MSExchange ActiveSync, event ID 1040, the description of which begins with "The average of the most recent [317] heartbeat intervals used by clients is less than or equal to [540].....". Another time the last recorded event is from MSExchange ADAccess, event ID 2080, the description for this one begins with "Process MAD.EXE (PID=4848). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
 (Server name | Roles | Enabled | ..."

I've got no idea what's going on.
Question by:spectra-qest
    LVL 63

    Expert Comment

    1) RUn DCDIAG and netdiag in verbose mode to text files

    2) Run Exchange BPA ( best practices analyzer )Also Baselin analyzer

    8-9 AM is the busiest time for logins, so maybe it is related to that also.

    How are resouces on the server ( RAM, CPU etc )
    Have you run perfmon in log mode ?

    I hope this helps !
    LVL 6

    Accepted Solution

    1.  Verify system is getting power from stable source
             A.  Connect primary power supply to a UPS.
             B.  Connect redundant power supply (if equipped) directly to receptacle on a separate circuit
    2.  Test UPS battery
    3.  Look for mini dumps from around the times of the crashes (%SystemRoot%\Minidump)
             A.  Look for full dumps if you have set them up (%SystemRoot%\MEMORY.DMP)
    LVL 6

    Expert Comment

    In Addition to the above advises, try to disable ASR (Automated System Restart). at least Auto restart might prevented and you might be able to see real time occurence of teh event.


    Author Comment

    Actually, it just so happens that the UPS has started beeping and the replace battery light is lit up now. I'm going to plug it straight into the wall and see if it keeps happening.

    Author Comment

    It turns out it was just the UPS. Odd that it would shut off the power just because the battery is dying, when it's still connected to the mains.

    Author Comment

    I feel so dumb right now :)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Top 6 Sources for Identifying Threat Actor TTPs

    Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

    You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
    Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
    In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
    The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now