Solved

SERVER shutting down everyday at a specific time

Posted on 2013-11-04
8
1,513 Views
Last Modified: 2014-12-21
Hi all,

I've got a SBS 2008 SERVER which is restarting at 12:13:14am everyday. The problem can be replicated by changing the time forward.

Event viewer log:

The process C:\Windows\system32\shutdown.exe (SERVER) has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x800000ff
 Shutdown Type: restart


MBAM, MSERT, ESET Online Scanners have brought no results.

Is there a tool which I can use to monitor what, who and where this process is getting executed from?
0
Comment
Question by:CBM Corporate
  • 2
  • 2
  • 2
  • +1
8 Comments
 
LVL 2

Expert Comment

by:pablito70
ID: 39623472
Did umyou check if the antivirus is configured for restarting after update?

In addition to you can check:

- On scheduled tasks
- If there is a setting to autorestart in case the treshold of trmperature of CPU or similar is configured

Hth
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 39623482
Check through your scheduled tasks.
0
 

Author Comment

by:CBM Corporate
ID: 39623492
Nothing in the scheduled tasks.
Nothing in the SQL scripts

The fact it can be replicated by changing the server time to 12:13:00 and it reboots systematically at 12:13:14 AM clearly indicates it is local, at it is scripted.

My question is around finding who, what, where, is running SHUTDOWN.exe process ? I can't find any way to enable deeper logging or auditing.
Any third party tool ?
0
U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 39623506
There are no other event log entries that seem odd?  A Service could have been configured to reboot the server if it fails.  You won't be able to tell WHO unless there's an account (other than system) associated with it (hopefully, you don't share one admin account amongst all admins) or someone actually noted it was them.
0
 
LVL 2

Expert Comment

by:pablito70
ID: 39623549
Are you configured automatic updates on the server or is part of WSUS system ?

The account claiming shutdown it is local system account so its seems really a win service scheduled.

Try to check on task manager if you see some processes that norma shouldn't be there.

Use systernal psexplorer for details.

Hth
0
 

Accepted Solution

by:
CBM Corporate earned 0 total points
ID: 39689078
Hi guys

I think a malware infected the machine before.
I applied all the windows updates that is possible and it seems to have fixed itself.
0
 
LVL 28

Expert Comment

by:jhyiesla
ID: 40511426
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Network it in WD Red

There's an industry-leading WD Red drive for every compatible NAS system to help fulfill your data storage needs. With drives up to 8TB, WD Red offers a wide array of solutions for customers looking to build the biggest, best-performing NAS storage solution.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
How to record audio from input sources to your PC – connected devices, connected preamp to record vinyl discs, streaming media, that play through your audio card: Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 – both 32 bit & 64.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now