XP PC shut down

i have several same model PCs shut down same time.
how do i check what's causing the problem?
Hiroyuki TamuraField EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Maybe if you enter in the Administrative Tools > Event Viewer you get some informations.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Check the event logs. Are they on the same power circuit? Or was there an update you installed prior to the problem?
Overheating may also be a problem. Use this app to check CPU temperature:

Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

If you get:

"This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT Authority\system.

Windows must now restart because Remote Procedure Call (RPC) Service terminated unexpectedly."

then try disabling Remote Procedure Call (RPC) in services.msc

start > run > services.msc > find RPC, stop, disable.

Then run a virus scan just to be sure.
What is your XP service Pack? before SP2 windows XP was vulnerable to blaster virur that uses RPC service to shutdown
The blaster virus is what I was referring to. Try to disinfect the system before taking the drastic measures I've posted above.
Hiroyuki TamuraField EngineerAuthor Commented:
Here is the event log.
Hiroyuki TamuraField EngineerAuthor Commented:
funny thing is they shut down same around time.
the pc used for symantec endopoint definition updater for each branch.
I found this on a different post here on ExpertsExchange that seems to directly relate to your problem:

It says, amongst other things, on your ' System.txt (438 KB) ' : "The process winlogon.exe has initiated the restart " and "Minor Reason: 0xff   Shutdown Type: reboot"  

check that other post... Hope it helps
Slav ZabickiSystem EngineerCommented:
you have a virus

to abort shutdown, open cmd and type shutdown -a

install malwarebytes and run full scan (or spybot)
you could try this.A MS patch might have caused the problem. Are they all fully patched or trying to fully patch?

Right click My Computer,
Advanced tab,
Settings button (Startup and Recovery),
uncheck Automatically Restart.

Not even a virus as it is more of an OS exploit: I've noticed this on legit versions of XP SP1 right after installation. It's an old problem with the solution being either to update to SP2-3 (if the computers aren't reflashed daily) or to disable RPC, and re-enable using an automatic registry fix if RPC being disabled is a problem.
Hiroyuki TamuraField EngineerAuthor Commented:
sorry, the other user was setting norton script to restart the PCs on every branch.
all PCs are atom pc and somehow doesn't restart after shut down.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Operating Systems

From novice to tech pro — start learning today.