[Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1564
  • Last Modified:

Windows Server keeps rebooting


Our Windows Server keeps rebooting usually at least once a day, usually around 8:00am to 9:00am and I have no idea why. Upon logging in to it again, I get the shutdown event tracker asking why the computer shut down unexpectedly - so I suspect that it may be getting a blue screen.

The server is a domain controller and Exchange 2007 server (among other roles).

I have looked in the Scheduled Tasks to see if there is anything around that time that may be causing it to crash or reboot, and found nothing. I have looked in the event viewer and found nothing of interest, although there does seem to be a few particular events that are always the last recorded events before it happens, albeit five to ten minutes beforehand.

The last recorded event in the System event log before each crash/reboot is an entry logged by the Service Control Manager and the description is either "The WinHTTP Web Proxy Auto-Discovery Service service entered the running state." or "The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state." (both of these have event IDs 7036) These give me no clue whatsoever because these events occur at plenty of other times throughout the night and day.

In the Application event log, I also find no clues. The last recorded event before each time differs. One time the last recorded event is just our spam blocker logging the fact that it blocked a spam message destined to a particular recipient. Two times the last recorded Application event is from MSExchange ActiveSync, event ID 1040, the description of which begins with "The average of the most recent [317] heartbeat intervals used by clients is less than or equal to [540].....". Another time the last recorded event is from MSExchange ADAccess, event ID 2080, the description for this one begins with "Process MAD.EXE (PID=4848). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
 (Server name | Roles | Enabled | ..."

I've got no idea what's going on.
1 Solution
1) RUn DCDIAG and netdiag in verbose mode to text files

2) Run Exchange BPA ( best practices analyzer )Also Baselin analyzer

8-9 AM is the busiest time for logins, so maybe it is related to that also.

How are resouces on the server ( RAM, CPU etc )
Have you run perfmon in log mode ?

I hope this helps !
1.  Verify system is getting power from stable source
         A.  Connect primary power supply to a UPS.
         B.  Connect redundant power supply (if equipped) directly to receptacle on a separate circuit
2.  Test UPS battery
3.  Look for mini dumps from around the times of the crashes (%SystemRoot%\Minidump)
         A.  Look for full dumps if you have set them up (%SystemRoot%\MEMORY.DMP)
In Addition to the above advises, try to disable ASR (Automated System Restart). at least Auto restart might prevented and you might be able to see real time occurence of teh event.

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

spectra-qestAuthor Commented:
Actually, it just so happens that the UPS has started beeping and the replace battery light is lit up now. I'm going to plug it straight into the wall and see if it keeps happening.
spectra-qestAuthor Commented:
It turns out it was just the UPS. Odd that it would shut off the power just because the battery is dying, when it's still connected to the mains.
spectra-qestAuthor Commented:
I feel so dumb right now :)

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now