?
Solved

reboot of a 2003 server

Posted on 2011-03-21
10
Medium Priority
?
966 Views
Last Modified: 2012-05-11
Hi All,

I have just taken over support of a 2003 server which reboots each night at 0400hrs.

Unfortunately I cannot find how/why it is doing this, there is no scheduled task for this.

any ideas greatly recieved.
thanks
gareth
0
Comment
Question by:gareth629
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 2
  • 2
  • +1
10 Comments
 
LVL 35

Expert Comment

by:Seth Simmons
ID: 35182525
Check Windows Update.  Is it configured to automatically install updates at that time?
0
 
LVL 10

Expert Comment

by:jramsier
ID: 35182555
Could be group policy or some remote computer on a schedule task to reboot that server.  Check group policy and see if there are any scripts that reboot it also check the event logs at that time to see if anyone or PC logged in right before the reboot.
0
 

Author Comment

by:gareth629
ID: 35182584
Thanks for the input guys,

Seth - Updates are switched off

JRamsier - I have had a good dig around group policy but I cannot find anything which fits. Do you have an idea where such a script would sit inside a GPO?

I event viewer it shows that winlogon starts the shutdown  process so I dont think it is a user or another pc.

thanks
gareth
0
Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

 
LVL 35

Expert Comment

by:Seth Simmons
ID: 35182629
look in system log for event id 1074 (user32) and see what that says

it shows the process that initiated the restart
0
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 35182961
Could be the AT scheduler service... type "at" on a command prompt
0
 

Author Comment

by:gareth629
ID: 35191400
hi Seth, this is the event

Event Type:      Information
Event Source:      USER32
Event Category:      None
Event ID:      1074
Date:            22/03/2011
Time:            04:00:10
User:            NT AUTHORITY\SYSTEM
Computer:      KOKSBS
Description:
The process winlogon.exe has initiated the restart of computer KOKSBS on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070015
 Shutdown Type: restart
 Comment:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 15 00 07 80               ...¿    


thanks
g
0
 

Author Comment

by:gareth629
ID: 35191409
leew

I typed at in the cmd prompt and received the reply "there are no entries in the list"

thanks
gareth
0
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 35192612
The shutdown should be occurring from somewhere...  ("no entried in the list" means it not an AT based scheduled task)

Another thought... try running AutoRuns and SilentRunners and see if you can find a startup location that is abnormal (Silent Runners is a VBS script that checks about 50+ locations and reports in a text file anything that is not standard... AutoRuns should be friendlier to use, but I've never compared the two closely to know if they truly check EVERYWHERE and I'm more inclined to trust Silent Runners (though Mark Russinovich did write Autoruns).  Google either and you should be able to find/download them.
0
 

Accepted Solution

by:
gareth629 earned 0 total points
ID: 35205320
thanks Lee, I will give it a go.

for the moment I have renamed Shutdown.exe which is temp work around but do need to find a proper fix.

thanks
g
0
 

Author Closing Comment

by:gareth629
ID: 36206152
renaming Shutdown stopped the rebooting and Shutdown.exe reappeared automatically.
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
In this video, Percona Solution Engineer Rick Golba discuss how (and why) you implement high availability in a database environment. To discuss how Percona Consulting can help with your design and architecture needs for your database and infrastr…
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question