Windows 8 Shuting Down Every Monday at 1 AM

Hi experts:

Since i started with some Windows 8 clients, i have a very strange problem... the ones that are always powered on are shuting down every Monday at 1 AM.

To resolve this, i tried a lot of configurations with no luck. Some of the configurations and caracteristics of the problem are this:

First of all i checked if there was a programed task that shutdown or restart my computer, but there are no tasks configured to do it.
The automatic updates are programed to be executed at 3 AM, so, they are not the ones that shudown                   the PCs, and also they are programed to RESTART the computers, not to shutdown them.
In some tutorials, people said that the process that was causing the problem was  the Windows 8 Hybrid Shutdown, that makes some kind of Hibernation to Power On in less time, so i disabled it, but computers are still shuting down.
I created a new Group Policy to reconfigure the automatic updates to be programed at another hour and disable the "auto-install high priority updates" option and configure the option that prevents the PCs to restart when an automatic update is performed.
How i know they are shuting down at 1 AM? i checked the System Logs and exactly at 1 AM the user SYSTEM starts the shutdown.exe process for 32 bits, located in WINDOWS_FOLDER\System32
The only clue i have is that it might be an application the one that it's shuting down the computers, cause i configured a clean install of the same Windows 8 version in a new computer, joined it to the domain, applied the same Group Policies and that's the only computer that is not shuting down.
All the computers are running the same Windows 8 version: 64 bits Professional
It's hard to determine which application (in case it is some specific software) is the one that fires the shutdown, cause the 3 computers that are powering off use different softwares, the only common software might be Microsoft Office 2010, WinRAR, Cobian Backup 11, Spark Client and ESET Endpoint Antivirus

Any comments are welcomed, or if anyone has resolved a similar problem please help me.

Regards,
Ricardo
LVL 6
Ricardo MartínezInformation SecurityAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

dipopoCommented:
What entries do you have in event viewer?
0
Ricardo MartínezInformation SecurityAuthor Commented:
I have some Group Policy update entries and than exactly at 1 o'clock in the morning a process executed by the SYSTEM user fires the shutdown.exe in System32 folder, than all the next entries are the services going down till the computer shutdown
0
dipopoCommented:
OK that to me seems like you have a WSUS policy attached to the GPO being applied and this is asking for the shutdown.

Can you further interrogate the GPO being applied and check this?
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

Ricardo MartínezInformation SecurityAuthor Commented:
No, i don't have a WSUS Server on my network, i only have configured automatic updates in the GPO, and in any case, i have a clean installed Windows 8 computer with the same policies applied and that one isn't shuting down.
0
Jason WatkinsIT Project LeaderCommented:
Does anything else happen at one a.m. Server backup or A/V definition updates, something like that?
0
Ricardo MartínezInformation SecurityAuthor Commented:
No, the only backups i perform are executed at 11:30 in the night, and A/V updates are executed as they are downloaded by the server. There are no other events at that hour. The previous events are the Group Policy refresh, that are executed every 1~2 hours, and exactly at 1:00:00 A.M. the shutdown event is fired without any description or clue of who launches it.
0
Sikhumbuzo NtsadaIT AdministrationCommented:
There are no scheduled tasks as well?
0
Jason WatkinsIT Project LeaderCommented:
Is S4 or S5 states enabled in the BIOS? On some Dells, I have noticed and needed to disable the feature from there.
0
McKnifeCommented:
Please quote the exact event wording.
0
Ricardo MartínezInformation SecurityAuthor Commented:
Santasi: No, no scheduled tasks.

Firebar: The computers are HP and they have the "Max Power Saving S5" disabled and the "Wake On LAN S5" enabled, even on the computer that is not shuting down.

McKnife: When i return to my office i will quote the event, and post a capture of the different events that execute at that hour.
0
Ricardo MartínezInformation SecurityAuthor Commented:
McKnife: here is the event log screenshot, it's in spanish, sorry but my clients all speak spanish hehe. This is kinda different cause it's a testing machine i have installed, and i forgot to change the hour, that's why it shows that the computer powered off at 11 P.M., but the problem is the same.
Windows-8-Shutdowns.jpg
0
McKnifeCommented:
Hmm. again a look at the tasks... Use schtasks to list the last runtime of all scheduled tasks as there are dozens preconfigured. Do it from an elevated command line.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ricardo MartínezInformation SecurityAuthor Commented:
It appears that there is a task scheduled to execute the shutdown.exe on System32 folder on the ESET Endpoint Antivirus, i don't really know why it is there, cause i didn't configured it in the Server and when i used Windows 7, i had the same antivirus and there was no shutdown task. Problem Solved, thanks to all helping me to pinpoint the problem.
0
Jason WatkinsIT Project LeaderCommented:
Glad to hear you have it solved.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 8

From novice to tech pro — start learning today.