Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

SBS 2008 spontaneous shutdown

Posted on 2013-10-28
3
677 Views
Last Modified: 2013-10-28
I've got a client with sbs 2008 running exchange and AD/DC onsite. This afternoon, the server spontaneously shut itself down, cleanly i might add, twice. 53 mins apart. I've reviewed the event logs and both times:

The process Explorer.EXE has initiated the shutdown of computer SRASERVER09 on behalf of user srafoods\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: shutdown
 Comment: jake

I've changed the administrator password and a third shutdown, 53 mins later or somewhere there abouts, has not occurred, which I would expect were this a service or application related error. I hesitate to make this accusation, because it has large implications in this case, but in the absence of other errors in the event log, does this error not point to the fact that someone intentionally shut this server down by way of the administrator account? I need to entertain all other possibilities.
0
Comment
Question by:sdholden28
  • 2
3 Comments
 
LVL 3

Expert Comment

by:ltechsolutions
ID: 39607531
Reason code 0x85000000 usually indicates someone has manually requested the shutdown.

When you select Shutdown, you're required to enter a 'comment' as a reason for the shutdown. In your example, whoever shut the server down entered "jake" as the comment before clicking OK.

Based on what I'm seeing, I find it highly unlikely that this was caused by any sort of program or script - it's fairly clear that this was done manually.
0
 

Author Comment

by:sdholden28
ID: 39607539
My thoughts exactly. Just wanted some other opinions. If I report my findings as "user initiated shutdown" then it's needs to be more than accurate.
0
 
LVL 3

Accepted Solution

by:
ltechsolutions earned 500 total points
ID: 39607544
Based on your post, I see no evidence to the contrary.

My official diagnosis is that the shutdown was manually initiated by the Administrator account.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
It’s been over a month into 2017, and there is already a sophisticated Gmail phishing email making it rounds. New techniques and tactics, have given hackers a way to authentically impersonate your contacts.How it Works The attack works by targeti…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question