?
Solved

Win 2008 R2 keeps turning Off Automatically

Posted on 2013-11-11
4
Medium Priority
?
5,877 Views
Last Modified: 2013-11-13
Hi All,


I have test server which is holding Xenapp roles and it's Vm server hosted in VMWARE.
Since last week friday ,My server is being turned off automatically...
While analyzing the log i found the following events..can some please help me on this.

Also,am using a trail version of Win 2008 R2 server..


Events:

This is the showing repeatedly whenver the turn off occurs

Log Name:      System
Source:        USER32
Date:          11/11/2013 6:01:10 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      TestXen.federated.fds
Description:
The process wininit.exe (127.0.0.1) has initiated the power off of computer TESTXEN on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
 Reason Code: 0x80070000
 Shutdown Type: power off
 Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-12T02:01:10.000000000Z" />
    <EventRecordID>6213</EventRecordID>
    <Channel>System</Channel>
    <Computer>TestXen.federated.fds</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>wininit.exe (127.0.0.1)</Data>
    <Data>TESTXEN</Data>
    <Data>Legacy API shutdown</Data>
    <Data>0x80070000</Data>
    <Data>power off</Data>
    <Data>
    </Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Binary>00000780000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>



Second :

Log Name:      System
Source:        Microsoft-Windows-Wininit
Date:          11/12/2013 9:44:56 AM
Event ID:      11
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      TestXen.federated.fds
Description:
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206F6DEA-D3C5-4D10-BC72-989F03C8B84B}" />
    <EventID>11</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-12T17:44:56.510040400Z" />
    <EventRecordID>6317</EventRecordID>
    <Correlation />
    <Execution ProcessID="756" ThreadID="812" />
    <Channel>System</Channel>
    <Computer>TestXen.federated.fds</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="StringCount">1</Data>
    <Data Name="String">C:\PROGRA~2\Citrix\System32\mfaphook64.dll</Data>
  </EventData>
</Event>
0
Comment
Question by:sekar_raj32
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 18

Accepted Solution

by:
Emmanuel Adebayo earned 750 total points
ID: 39640831
Is your server attached to UPS?

Did you check to see if there is any task schedule?

Did you do any security patches of recent?

Also, check the power management settings
0
 
LVL 26

Assisted Solution

by:Tony J
Tony J earned 750 total points
ID: 39640887
Unfortunately all that event tells us is that something initiated a programmatical shutdown using what is actually an old mechanism.

Around the same time in the event logs should be someting else that tells you what actually initiated it.

Also things to check include that VMwareisn't set up to perform either a scheduled or smart shutdown - depending on the version, it can power down machines that aren't in use so I would check your tasks and events in VMware.
0
 
LVL 7

Author Comment

by:sekar_raj32
ID: 39644022
Hi guys,


Thanks for you participation..I found out the answer by myself....As mentioned above My trail version got expired which is intiating the shutdown every one hr...

Once i ran a command slmmgr to extend the trail and it worked and no more the server is rebooting ...thank you again..
0
 
LVL 7

Author Closing Comment

by:sekar_raj32
ID: 39644026
Hi guys,


Thanks for you participation..I found out the answer by myself....As mentioned above My trail version got expired which is intiating the shutdown every one hr...

Once i ran a command slmmgr to extend the trail and it worked and no more the server is rebooting ...thank you again..
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question