Solved

reboot of a 2003 server

Posted on 2011-03-21
10
954 Views
Last Modified: 2012-05-11
Hi All,

I have just taken over support of a 2003 server which reboots each night at 0400hrs.

Unfortunately I cannot find how/why it is doing this, there is no scheduled task for this.

any ideas greatly recieved.
thanks
gareth
0
Comment
Question by:gareth629
  • 5
  • 2
  • 2
  • +1
10 Comments
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 35182525
Check Windows Update.  Is it configured to automatically install updates at that time?
0
 
LVL 10

Expert Comment

by:jramsier
ID: 35182555
Could be group policy or some remote computer on a schedule task to reboot that server.  Check group policy and see if there are any scripts that reboot it also check the event logs at that time to see if anyone or PC logged in right before the reboot.
0
 

Author Comment

by:gareth629
ID: 35182584
Thanks for the input guys,

Seth - Updates are switched off

JRamsier - I have had a good dig around group policy but I cannot find anything which fits. Do you have an idea where such a script would sit inside a GPO?

I event viewer it shows that winlogon starts the shutdown  process so I dont think it is a user or another pc.

thanks
gareth
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 34

Expert Comment

by:Seth Simmons
ID: 35182629
look in system log for event id 1074 (user32) and see what that says

it shows the process that initiated the restart
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 35182961
Could be the AT scheduler service... type "at" on a command prompt
0
 

Author Comment

by:gareth629
ID: 35191400
hi Seth, this is the event

Event Type:      Information
Event Source:      USER32
Event Category:      None
Event ID:      1074
Date:            22/03/2011
Time:            04:00:10
User:            NT AUTHORITY\SYSTEM
Computer:      KOKSBS
Description:
The process winlogon.exe has initiated the restart of computer KOKSBS on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070015
 Shutdown Type: restart
 Comment:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 15 00 07 80               ...¿    


thanks
g
0
 

Author Comment

by:gareth629
ID: 35191409
leew

I typed at in the cmd prompt and received the reply "there are no entries in the list"

thanks
gareth
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 35192612
The shutdown should be occurring from somewhere...  ("no entried in the list" means it not an AT based scheduled task)

Another thought... try running AutoRuns and SilentRunners and see if you can find a startup location that is abnormal (Silent Runners is a VBS script that checks about 50+ locations and reports in a text file anything that is not standard... AutoRuns should be friendlier to use, but I've never compared the two closely to know if they truly check EVERYWHERE and I'm more inclined to trust Silent Runners (though Mark Russinovich did write Autoruns).  Google either and you should be able to find/download them.
0
 

Accepted Solution

by:
gareth629 earned 0 total points
ID: 35205320
thanks Lee, I will give it a go.

for the moment I have renamed Shutdown.exe which is temp work around but do need to find a proper fix.

thanks
g
0
 

Author Closing Comment

by:gareth629
ID: 36206152
renaming Shutdown stopped the rebooting and Shutdown.exe reappeared automatically.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Organizations create, modify, and maintain huge amounts of data to help their businesses earn money and generally function.  Typically every network user within an organization has a bit of disk space to store in process items and personal files.   …
I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question