Solved

Win 2008 R2 keeps turning Off Automatically

Posted on 2013-11-11
4
5,251 Views
Last Modified: 2013-11-13
Hi All,


I have test server which is holding Xenapp roles and it's Vm server hosted in VMWARE.
Since last week friday ,My server is being turned off automatically...
While analyzing the log i found the following events..can some please help me on this.

Also,am using a trail version of Win 2008 R2 server..


Events:

This is the showing repeatedly whenver the turn off occurs

Log Name:      System
Source:        USER32
Date:          11/11/2013 6:01:10 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      TestXen.federated.fds
Description:
The process wininit.exe (127.0.0.1) has initiated the power off of computer TESTXEN on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
 Reason Code: 0x80070000
 Shutdown Type: power off
 Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-12T02:01:10.000000000Z" />
    <EventRecordID>6213</EventRecordID>
    <Channel>System</Channel>
    <Computer>TestXen.federated.fds</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>wininit.exe (127.0.0.1)</Data>
    <Data>TESTXEN</Data>
    <Data>Legacy API shutdown</Data>
    <Data>0x80070000</Data>
    <Data>power off</Data>
    <Data>
    </Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Binary>00000780000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>



Second :

Log Name:      System
Source:        Microsoft-Windows-Wininit
Date:          11/12/2013 9:44:56 AM
Event ID:      11
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      TestXen.federated.fds
Description:
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206F6DEA-D3C5-4D10-BC72-989F03C8B84B}" />
    <EventID>11</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-12T17:44:56.510040400Z" />
    <EventRecordID>6317</EventRecordID>
    <Correlation />
    <Execution ProcessID="756" ThreadID="812" />
    <Channel>System</Channel>
    <Computer>TestXen.federated.fds</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="StringCount">1</Data>
    <Data Name="String">C:\PROGRA~2\Citrix\System32\mfaphook64.dll</Data>
  </EventData>
</Event>
0
Comment
Question by:sekar_raj32
  • 2
4 Comments
 
LVL 17

Accepted Solution

by:
Emmanuel Adebayo earned 250 total points
ID: 39640831
Is your server attached to UPS?

Did you check to see if there is any task schedule?

Did you do any security patches of recent?

Also, check the power management settings
0
 
LVL 25

Assisted Solution

by:Tony Johncock
Tony Johncock earned 250 total points
ID: 39640887
Unfortunately all that event tells us is that something initiated a programmatical shutdown using what is actually an old mechanism.

Around the same time in the event logs should be someting else that tells you what actually initiated it.

Also things to check include that VMwareisn't set up to perform either a scheduled or smart shutdown - depending on the version, it can power down machines that aren't in use so I would check your tasks and events in VMware.
0
 
LVL 7

Author Comment

by:sekar_raj32
ID: 39644022
Hi guys,


Thanks for you participation..I found out the answer by myself....As mentioned above My trail version got expired which is intiating the shutdown every one hr...

Once i ran a command slmmgr to extend the trail and it worked and no more the server is rebooting ...thank you again..
0
 
LVL 7

Author Closing Comment

by:sekar_raj32
ID: 39644026
Hi guys,


Thanks for you participation..I found out the answer by myself....As mentioned above My trail version got expired which is intiating the shutdown every one hr...

Once i ran a command slmmgr to extend the trail and it worked and no more the server is rebooting ...thank you again..
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I was supporting a handful of Windows 2008 (non-R2) 2 node clusters with shared quorum disks. Some had SQL 2008 installed and some were just a vendor application that we supported. For the purposes of this article it doesn’t really matter which so w…
You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question