Solved

reboot of a 2003 server

Posted on 2011-03-21
10
951 Views
Last Modified: 2012-05-11
Hi All,

I have just taken over support of a 2003 server which reboots each night at 0400hrs.

Unfortunately I cannot find how/why it is doing this, there is no scheduled task for this.

any ideas greatly recieved.
thanks
gareth
0
Comment
Question by:gareth629
  • 5
  • 2
  • 2
  • +1
10 Comments
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 35182525
Check Windows Update.  Is it configured to automatically install updates at that time?
0
 
LVL 10

Expert Comment

by:jramsier
ID: 35182555
Could be group policy or some remote computer on a schedule task to reboot that server.  Check group policy and see if there are any scripts that reboot it also check the event logs at that time to see if anyone or PC logged in right before the reboot.
0
 

Author Comment

by:gareth629
ID: 35182584
Thanks for the input guys,

Seth - Updates are switched off

JRamsier - I have had a good dig around group policy but I cannot find anything which fits. Do you have an idea where such a script would sit inside a GPO?

I event viewer it shows that winlogon starts the shutdown  process so I dont think it is a user or another pc.

thanks
gareth
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 34

Expert Comment

by:Seth Simmons
ID: 35182629
look in system log for event id 1074 (user32) and see what that says

it shows the process that initiated the restart
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 35182961
Could be the AT scheduler service... type "at" on a command prompt
0
 

Author Comment

by:gareth629
ID: 35191400
hi Seth, this is the event

Event Type:      Information
Event Source:      USER32
Event Category:      None
Event ID:      1074
Date:            22/03/2011
Time:            04:00:10
User:            NT AUTHORITY\SYSTEM
Computer:      KOKSBS
Description:
The process winlogon.exe has initiated the restart of computer KOKSBS on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070015
 Shutdown Type: restart
 Comment:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 15 00 07 80               ...¿    


thanks
g
0
 

Author Comment

by:gareth629
ID: 35191409
leew

I typed at in the cmd prompt and received the reply "there are no entries in the list"

thanks
gareth
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 35192612
The shutdown should be occurring from somewhere...  ("no entried in the list" means it not an AT based scheduled task)

Another thought... try running AutoRuns and SilentRunners and see if you can find a startup location that is abnormal (Silent Runners is a VBS script that checks about 50+ locations and reports in a text file anything that is not standard... AutoRuns should be friendlier to use, but I've never compared the two closely to know if they truly check EVERYWHERE and I'm more inclined to trust Silent Runners (though Mark Russinovich did write Autoruns).  Google either and you should be able to find/download them.
0
 

Accepted Solution

by:
gareth629 earned 0 total points
ID: 35205320
thanks Lee, I will give it a go.

for the moment I have renamed Shutdown.exe which is temp work around but do need to find a proper fix.

thanks
g
0
 

Author Closing Comment

by:gareth629
ID: 36206152
renaming Shutdown stopped the rebooting and Shutdown.exe reappeared automatically.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question