?
Solved

SBS 2008 spontaneous shutdown

Posted on 2013-10-28
3
Medium Priority
?
735 Views
Last Modified: 2013-10-28
I've got a client with sbs 2008 running exchange and AD/DC onsite. This afternoon, the server spontaneously shut itself down, cleanly i might add, twice. 53 mins apart. I've reviewed the event logs and both times:

The process Explorer.EXE has initiated the shutdown of computer SRASERVER09 on behalf of user srafoods\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: shutdown
 Comment: jake

I've changed the administrator password and a third shutdown, 53 mins later or somewhere there abouts, has not occurred, which I would expect were this a service or application related error. I hesitate to make this accusation, because it has large implications in this case, but in the absence of other errors in the event log, does this error not point to the fact that someone intentionally shut this server down by way of the administrator account? I need to entertain all other possibilities.
0
Comment
Question by:sdholden28
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 3

Expert Comment

by:ltechsolutions
ID: 39607531
Reason code 0x85000000 usually indicates someone has manually requested the shutdown.

When you select Shutdown, you're required to enter a 'comment' as a reason for the shutdown. In your example, whoever shut the server down entered "jake" as the comment before clicking OK.

Based on what I'm seeing, I find it highly unlikely that this was caused by any sort of program or script - it's fairly clear that this was done manually.
0
 

Author Comment

by:sdholden28
ID: 39607539
My thoughts exactly. Just wanted some other opinions. If I report my findings as "user initiated shutdown" then it's needs to be more than accurate.
0
 
LVL 3

Accepted Solution

by:
ltechsolutions earned 2000 total points
ID: 39607544
Based on your post, I see no evidence to the contrary.

My official diagnosis is that the shutdown was manually initiated by the Administrator account.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question