Solved

SBS 2008 spontaneous shutdown

Posted on 2013-10-28
3
687 Views
Last Modified: 2013-10-28
I've got a client with sbs 2008 running exchange and AD/DC onsite. This afternoon, the server spontaneously shut itself down, cleanly i might add, twice. 53 mins apart. I've reviewed the event logs and both times:

The process Explorer.EXE has initiated the shutdown of computer SRASERVER09 on behalf of user srafoods\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: shutdown
 Comment: jake

I've changed the administrator password and a third shutdown, 53 mins later or somewhere there abouts, has not occurred, which I would expect were this a service or application related error. I hesitate to make this accusation, because it has large implications in this case, but in the absence of other errors in the event log, does this error not point to the fact that someone intentionally shut this server down by way of the administrator account? I need to entertain all other possibilities.
0
Comment
Question by:sdholden28
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 3

Expert Comment

by:ltechsolutions
ID: 39607531
Reason code 0x85000000 usually indicates someone has manually requested the shutdown.

When you select Shutdown, you're required to enter a 'comment' as a reason for the shutdown. In your example, whoever shut the server down entered "jake" as the comment before clicking OK.

Based on what I'm seeing, I find it highly unlikely that this was caused by any sort of program or script - it's fairly clear that this was done manually.
0
 

Author Comment

by:sdholden28
ID: 39607539
My thoughts exactly. Just wanted some other opinions. If I report my findings as "user initiated shutdown" then it's needs to be more than accurate.
0
 
LVL 3

Accepted Solution

by:
ltechsolutions earned 500 total points
ID: 39607544
Based on your post, I see no evidence to the contrary.

My official diagnosis is that the shutdown was manually initiated by the Administrator account.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question