• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 981
  • Last Modified:

reboot of a 2003 server

Hi All,

I have just taken over support of a 2003 server which reboots each night at 0400hrs.

Unfortunately I cannot find how/why it is doing this, there is no scheduled task for this.

any ideas greatly recieved.
thanks
gareth
0
Gareth McKee
Asked:
Gareth McKee
  • 5
  • 2
  • 2
  • +1
1 Solution
 
Seth SimmonsSr. Systems AdministratorCommented:
Check Windows Update.  Is it configured to automatically install updates at that time?
0
 
jramsierCommented:
Could be group policy or some remote computer on a schedule task to reboot that server.  Check group policy and see if there are any scripts that reboot it also check the event logs at that time to see if anyone or PC logged in right before the reboot.
0
 
Gareth McKeeCEO/OwnerAuthor Commented:
Thanks for the input guys,

Seth - Updates are switched off

JRamsier - I have had a good dig around group policy but I cannot find anything which fits. Do you have an idea where such a script would sit inside a GPO?

I event viewer it shows that winlogon starts the shutdown  process so I dont think it is a user or another pc.

thanks
gareth
0
Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

 
Seth SimmonsSr. Systems AdministratorCommented:
look in system log for event id 1074 (user32) and see what that says

it shows the process that initiated the restart
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
Could be the AT scheduler service... type "at" on a command prompt
0
 
Gareth McKeeCEO/OwnerAuthor Commented:
hi Seth, this is the event

Event Type:      Information
Event Source:      USER32
Event Category:      None
Event ID:      1074
Date:            22/03/2011
Time:            04:00:10
User:            NT AUTHORITY\SYSTEM
Computer:      KOKSBS
Description:
The process winlogon.exe has initiated the restart of computer KOKSBS on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070015
 Shutdown Type: restart
 Comment:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 15 00 07 80               ...¿    


thanks
g
0
 
Gareth McKeeCEO/OwnerAuthor Commented:
leew

I typed at in the cmd prompt and received the reply "there are no entries in the list"

thanks
gareth
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
The shutdown should be occurring from somewhere...  ("no entried in the list" means it not an AT based scheduled task)

Another thought... try running AutoRuns and SilentRunners and see if you can find a startup location that is abnormal (Silent Runners is a VBS script that checks about 50+ locations and reports in a text file anything that is not standard... AutoRuns should be friendlier to use, but I've never compared the two closely to know if they truly check EVERYWHERE and I'm more inclined to trust Silent Runners (though Mark Russinovich did write Autoruns).  Google either and you should be able to find/download them.
0
 
Gareth McKeeCEO/OwnerAuthor Commented:
thanks Lee, I will give it a go.

for the moment I have renamed Shutdown.exe which is temp work around but do need to find a proper fix.

thanks
g
0
 
Gareth McKeeCEO/OwnerAuthor Commented:
renaming Shutdown stopped the rebooting and Shutdown.exe reappeared automatically.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now