Certain Windows Services Are Issued a Stop Command by NT Authority\System

Every morning at 3:00:26 AM on the dot our Access Control Server Services are issued a stop command by NT Authority\System.  I don't know why or how these services are being told to stop, but they prevent our Access Control Server from functioning.

We have put this machine in an exclusion list from any and all domain GPO pushes and the services still stop.

One morning at 2:58 we unplugged the network cable, and the services stayed running--they were never issued a stop command.  

Where can I go to determine what is telling NT Authority\System to stop services at 3:00AM.  

Thanks!
Taylor HuckstepSenior Director, ITAsked:
Who is Participating?
 
KenneniahConnect With a Mentor Commented:
Judging by the time, my guess would be something with automatic updates, as by default they are set to install at 3am. At a guess some update that needs those services stopped to update is running and getting stuck. Anything in the update log?
0
 
Donald StewartNetwork AdministratorCommented:
I would go thru scheduled tasks
0
 
Taylor HuckstepSenior Director, ITAuthor Commented:
No Scheduled Tasks. :(

Only thing listed is Add Scheduled Task.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
johnb6767Commented:
Check the Security log from the Event Viewer, and see if you can match a Logon Event from that time frame, and see what the Logon Type Code is, and see if it also lists a source Workstation.....
0
 
johnb6767Commented:
Probably a Logon Type Code 3, coming from another machine....
0
 
Donald StewartNetwork AdministratorCommented:
It can be scheduled tasks on any machine in your network
0
 
KenneniahCommented:
And by update log, I mean WindowsUpdate.log in the Windows directory
0
 
johnb6767Commented:
Nice catch.....  :)
0
 
Taylor HuckstepSenior Director, ITAuthor Commented:
It would Appear Kenneniah is correct.  I disabled windows update and services never stopped.  I looked in the log (and although it's a bit confusing) it appears the system was trying to install SQL 2005 SP2 and failing.

I'm waiting on confirmation from my system admin that the problem is resolved and will award points.

Thanks for all the suggestions here!
0
 
Taylor HuckstepSenior Director, ITAuthor Commented:
You nailed it with the 3am.  System was trying to update SQL Server 2005 SP2 and stopping required services to the security database and failing to do the upgrade, then failing to restart services.

Thanks!
0
All Courses

From novice to tech pro — start learning today.