Unexplained reboots - Win2003 SP2 - The process winlogon.exe has initiated the restart of computer

Posted on 2010-03-31
Medium Priority
Last Modified: 2012-05-09
Unexplained reboots - Win2003 SP2 - The process winlogon.exe has initiated the restart of computer.
System starts to shutdown by itself and by giving countdown to reboot. It happens a few times a day. It also fails to reboot.
Question by:akeramat
  • 3
  • 2
  • 2
  • +1

Expert Comment

by:Darren Sharples
ID: 29238184
maybe a corrupt profile or virus, not to sure. you can issue a shutdown -a to prevent it when you see it while you diagnose

Author Comment

ID: 29240085
Thanks Sharpting.
I will try this while I need to know how to rrouble shoot this problem.
LVL 66

Expert Comment

ID: 29243342
Look in the Event Viewer, under the source User32 and see if it gives any hints as to what initiated the shutdown... Might get lucky.....


reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /s winlog.reg
notepad winlog.reg

Post the results here please..... It might be an infection thats loaded under the Winlogon process causing the problem.....
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.


Expert Comment

by:Darren Sharples
ID: 29243644
1. hit control alt delete and click the processes tab, have a look for any suspicous virusy looking files that are running.

2. search for that file and delete all instances of it.

3. run a virus scan http://housecall.trendmicro.com/uk/ and install spybot and run that.

if your not sure what suspicous virusy files look like then just skip straight to step 3.
LVL 24

Expert Comment

by:B H
ID: 29271165
is this 'small business server' with another domain controller on the network?  if so, the sbs server knows, and will shutdown/reboot itself every day or so - but it does a good job about logging it in the "...reason for the shutdown was: " section of the event logs.

what happens in your event logs just before the shutdown is logged?

Author Comment

ID: 29276743
Thanks all for all the tips and suggestions.
This was a PC connected to Network. Somehow the profile was corrupted.
We restored to an earlier date and disjoined the PC from domain and rejoined it to the domain,
and it worked. Everything seemingly is fine. We can calose this issue.
LVL 66

Accepted Solution

johnb6767 earned 2000 total points
ID: 29297405
"Everything seemingly is fine"

System Restore doesnt remove the viral files that are responsible for these types of threats, just be aware.....

Author Closing Comment

ID: 31709531
Thanks, i will be aware.

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Nuance's PaperPort may display this error message: PaperPort appears to be running Windows XP Compatibility Mode which may result in errors. We recommend disabling Compatibility Mode for the PaprPort.exe program, see Technote 6629. This articl…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Watch the video to know the simple way to remove or recover or reset lost or forgotten passwords of Outlook PST file. With Kernel Outlook Password Recovery tool such operation is very easy to perform. It is a freeware with limitation to use with 500…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question