• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 194
  • Last Modified:

Exchange 2003 automatic reboot

Hey all,

See the attached screenshots (in order). Last week our Exchange 2003 Enterprise (SP2) server rebooted. LSASS.exe faulted, and forced the winlogon.exe to reboot the machine. This is the first time it has happened. I am really trying to figure out what might cause this to happen. I called MS support and since our current support only works in break-fix mode we were not able to really troubleshoot. I know a lot of LSASS issues are related to virus/malware, and the machine has been scanned fine, no issues there. I am not sure if anyone else has seen this before. As much as I know "these things sometime happen with Windows servers" I don't have a lot of confidence that it won't happen again. Thanks.
1.jpg
2.jpg
3.jpg
4.jpg
0
exadmin2006
Asked:
exadmin2006
  • 3
  • 2
1 Solution
 
jasin00Commented:
can people access your server remotely? disable the remote registry service and lock down your rdp groups.  check and see whos in your domain admin groups and look at who can issue a remote shutdown on the box on your local security or GP. exchange servers just don't reboot themselves.
0
 
exadmin2006Author Commented:
Thanks. In this case, the winlogon.exe process initiated the reboot on behalf of the server. Do you mean this might have been user initiated? Thanks. To answer your other question, yes, myself and a few Domain Admins have RDP access as well as console level access to the server.
0
 
jasin00Commented:
oh and does the server have stable power?
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
exadmin2006Author Commented:
Stable? It had two supplies, both plugged in...it's in a production datacenter, so it's not in a cube or anything with direct wall power (I've seen this before...HAHA).
0
 
Mark DamenERP System ManagerCommented:
I would rule out this being caused by a manual restart.  Something in the system has caused it to happen.  I guess it's hard to troubleshoot as it's only happened once, but if it happens again I would try changing the RAM.  I've commonly found that faulting modules and fault buckets point back to the RAM playing up, perhaps an overheating issue?
0

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now