Solved

reboot of a 2003 server

Posted on 2011-03-21
10
942 Views
Last Modified: 2012-05-11
Hi All,

I have just taken over support of a 2003 server which reboots each night at 0400hrs.

Unfortunately I cannot find how/why it is doing this, there is no scheduled task for this.

any ideas greatly recieved.
thanks
gareth
0
Comment
Question by:gareth629
  • 5
  • 2
  • 2
  • +1
10 Comments
 
LVL 34

Expert Comment

by:Seth Simmons
Comment Utility
Check Windows Update.  Is it configured to automatically install updates at that time?
0
 
LVL 10

Expert Comment

by:jramsier
Comment Utility
Could be group policy or some remote computer on a schedule task to reboot that server.  Check group policy and see if there are any scripts that reboot it also check the event logs at that time to see if anyone or PC logged in right before the reboot.
0
 

Author Comment

by:gareth629
Comment Utility
Thanks for the input guys,

Seth - Updates are switched off

JRamsier - I have had a good dig around group policy but I cannot find anything which fits. Do you have an idea where such a script would sit inside a GPO?

I event viewer it shows that winlogon starts the shutdown  process so I dont think it is a user or another pc.

thanks
gareth
0
 
LVL 34

Expert Comment

by:Seth Simmons
Comment Utility
look in system log for event id 1074 (user32) and see what that says

it shows the process that initiated the restart
0
 
LVL 95

Expert Comment

by:Lee W, MVP
Comment Utility
Could be the AT scheduler service... type "at" on a command prompt
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:gareth629
Comment Utility
hi Seth, this is the event

Event Type:      Information
Event Source:      USER32
Event Category:      None
Event ID:      1074
Date:            22/03/2011
Time:            04:00:10
User:            NT AUTHORITY\SYSTEM
Computer:      KOKSBS
Description:
The process winlogon.exe has initiated the restart of computer KOKSBS on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070015
 Shutdown Type: restart
 Comment:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 15 00 07 80               ...¿    


thanks
g
0
 

Author Comment

by:gareth629
Comment Utility
leew

I typed at in the cmd prompt and received the reply "there are no entries in the list"

thanks
gareth
0
 
LVL 95

Expert Comment

by:Lee W, MVP
Comment Utility
The shutdown should be occurring from somewhere...  ("no entried in the list" means it not an AT based scheduled task)

Another thought... try running AutoRuns and SilentRunners and see if you can find a startup location that is abnormal (Silent Runners is a VBS script that checks about 50+ locations and reports in a text file anything that is not standard... AutoRuns should be friendlier to use, but I've never compared the two closely to know if they truly check EVERYWHERE and I'm more inclined to trust Silent Runners (though Mark Russinovich did write Autoruns).  Google either and you should be able to find/download them.
0
 

Accepted Solution

by:
gareth629 earned 0 total points
Comment Utility
thanks Lee, I will give it a go.

for the moment I have renamed Shutdown.exe which is temp work around but do need to find a proper fix.

thanks
g
0
 

Author Closing Comment

by:gareth629
Comment Utility
renaming Shutdown stopped the rebooting and Shutdown.exe reappeared automatically.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Join & Write a Comment

Organizations create, modify, and maintain huge amounts of data to help their businesses earn money and generally function.  Typically every network user within an organization has a bit of disk space to store in process items and personal files.   …
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now