Solved

Server restart

Posted on 2013-02-01
7
308 Views
Last Modified: 2013-02-07
Please help, I need to find out why my server restart (Server 2008). I have a IIS server, it restart by-itself this morning around 8:30am, I saw at the NIC property, it shows duration since it restarted from 8:30am. From event views, in system, application and security they all show events after restart, is there anyway I can find out who or why this server restarted? Thank you in advance =)
0
Comment
Question by:weikiiro
  • 3
  • 3
7 Comments
 
LVL 5

Expert Comment

by:xperttech
Comment Utility
Have you selected to apply Windows Updates automatically?
0
 
LVL 20

Expert Comment

by:CompProbSolv
Comment Utility
The event log should indicate if the restart was unexpected (possibly caused by power failure) or not.  That distinction will help greatly in determining the direction to look.
0
 

Author Comment

by:weikiiro
Comment Utility
Last windows update was on 5/11/2012.

In system log it shows unexpected shutdown, after server come back, and I put in "Other". Please see attachment.
System-Event-Logs.jpg
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 5

Accepted Solution

by:
xperttech earned 500 total points
Comment Utility
This looks like a crash. Perhaps the "Other" reason was provided "after the fact". When you logged in, it warned you of improper shutdown and asked for the reason.

I would check the system folder for a dump or mini-dump. Probably a bad driver could have cause a BSOD (Blue Screen of Death).

-XT
0
 

Author Comment

by:weikiiro
Comment Utility
Yes, I input the "Other" reason after server come back.
This is a VM running on local storage, local storage looks ok, please see attachment.
Where I should find the dump or mini-dump file? detail path please for server 2008. Thank you =)
Local-storage.jpg
0
 

Author Comment

by:weikiiro
Comment Utility
And what should I look for in the dump file? =)
0
 
LVL 5

Assisted Solution

by:xperttech
xperttech earned 500 total points
Comment Utility
Click Start, and then click Control Panel.
Click Performance and Maintenance, and then click System.
On the Advanced tab, click Settings under Startup and Recovery.

Source: http://support.microsoft.com/kb/254649?wa=wsignin1.0


You can use Dumpchk.exe to inspect the dump file:
http://support.microsoft.com/kb/156280
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now