Can't find reason for Windows 7 Auto Shutdown

Last year I somehow created an automatic shurdown at 11:30 p.m. for a client's Win 7 Pro PC, and now I can't remember what I did!

I need to stop it from shutting down automatically at the customer's request. I looked in the task scheduler, where I would have thought I would have created a call to shutdown.exe, but no such task exists.

So my bottom line is that I can't figure out how to undo my own auto shutdown. Crazy, I know! Can anyone tell me what to look for?

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Or could you have installed this program:;pop
Auto Shutdown
bricar1PresidentAuthor Commented:
No, neither of these were done. Just to make sure I did a search for all .bat files.

I'm baffled by this. Again, normally I would do it in the task scheduler but I just don't see the task listed. Same user, admin privileges.

Any other ideas, anybody?
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

bricar1PresidentAuthor Commented:
No, it wasn't a program.

This should be easy. If you are perfectly sure that it shuts down at 11:30 every day, then it's a scheduler and nothing else. So first check if there are other 3rd party schedulers active. You could simply look at the processes in task manager. If there is no other scheduler active, make sure, that the shutdown is not triggered from a remote computer - simply disconnect the network a few minutes before. If it still shuts down, it has to be the local scheduler. So start cmd.exe elevated by rightclicking it and selecting "run as administrator" and run the command
schtasks |findstr 11:30 

Open in new window

to see whether you simply overlooked it.

If that does not help, use procmon to monitor what's going on - but you have to configure procmon first: set it to use a backing file (hit ctrl+B) instead of the pagefile, so that your recordings are not lost when the computer is beeing shut down. Next time you open procmon, pay attention not to overwrite that file but simply start procmon and open the latest backing file and analyse - good luck in finding it.

So just for the method:
1) disconnect the network
2) make sure that no 3rd parfty schedulers are started
3) (elevated command) schtasks |findstr 11:30
4) start procmon with backing file

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bricar1PresidentAuthor Commented:
I'll try your suggestions.

Interestingly, there is a "sister" machine right next to that one (same OS and same basic setup) that DOES INDEED show the "Shutdown" task that I created for that one at 11:00 p.m.

So I have one computer that shuts down at 11:30 and does not list the task, and another computer right next to it (they are in a 2-computer workgroup) that shuts down at 11:00 and DOES show the task!

I decided to disable the task on the 2nd machine.
bricar1PresidentAuthor Commented:
Just did the search and nothing came up for 11:30, tried again with 11 and two unrelated tasks came up.

So the indication is that the task does not exist!

I need to try to stop the PC from shutting down tonight (because the client just went away on vacation and wants to access it with Splashtop Remote on their iPad - Tested out perfectly yesterday), and if it shuts down I might not be able to restart it remotely (only if BIOS allows).

I was thinking of trying to bypass the shutdown in one of two ways:

1) Rename "shutdown.exe" to prevent it from running.
2) Create a new task (if possible) to RE-START (instead of shut down) at 11:28. This could conceivably prevent the shutdown command from having any effect.

In other words, the computer would be engaged in the process of rebooting while the "shutdown" command was supposed to execute, thereby rendering it ineffective.

Any thoughts on those possibilities?
1) possible if you circumvent windows resource protection there are google hints on how to. However there could be other shutdown methods involved.
2) try it, could work if the server is slow on starting. I would use  11:29:45. However, if the task or whatever it is, is setup to rerun missed starts, that won't work.

So 3) a scheduled restart using a wake on lan tool like WOL would be better just to make sure it's available.
bricar1PresidentAuthor Commented:
It's not a server, rather a Windows 7 machine.

This attempt at a fix is a one shot deal because the client went away on vacation today and the machine is scheduled for a shutdown at 11:30. Once it shuts down I will have no access to it until she returns in a week. She was hoping to be able to access this computer via her iPad remotely, and that will be impossible if the machine shuts down.

I suppose I could knock the clock back in order to buy some time.

Not sure if Wake on Lan is enabled in BIOS, and can't check because I have no access to the site.
Wait - try to modify who is allowed to shutdown the system. Simply remove everyone.
bricar1PresidentAuthor Commented:
I set up a test run on my Win 7 box here. I set up a hard time for shutdown and tested it. Then I set up a restart one minute before in order to interrupt the shutdown. It worked. I got a simple reboot and there was no problem. I just implemented it on the client's machine remotely, and I will report back tomorrow whether it worked or not. Fingers crossed. Thanks for the help! More tomorrow...
bricar1PresidentAuthor Commented:

All good idea. Points awarded, but I ended up having to implement that automatic reboot in order to overlap the shutdown. It works fine. I'll look into it more when I end up on-site. Thanks for the help!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.