Kamalasekar Parthasarathy
asked on
Win 2008 R2 keeps turning Off Automatically
Hi All,
I have test server which is holding Xenapp roles and it's Vm server hosted in VMWARE.
Since last week friday ,My server is being turned off automatically...
While analyzing the log i found the following events..can some please help me on this.
Also,am using a trail version of Win 2008 R2 server..
Events:
This is the showing repeatedly whenver the turn off occurs
Log Name: System
Source: USER32
Date: 11/11/2013 6:01:10 PM
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: TestXen.federated.fds
Description:
The process wininit.exe (127.0.0.1) has initiated the power off of computer TESTXEN on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shutdown Type: power off
Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="USER32" />
<EventID Qualifiers="32768">1074</E ventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000 </Keywords >
<TimeCreated SystemTime="2013-11-12T02: 01:10.0000 00000Z" />
<EventRecordID>6213</Event RecordID>
<Channel>System</Channel>
<Computer>TestXen.federate d.fds</Com puter>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>wininit.exe (127.0.0.1)</Data>
<Data>TESTXEN</Data>
<Data>Legacy API shutdown</Data>
<Data>0x80070000</Data>
<Data>power off</Data>
<Data>
</Data>
<Data>NT AUTHORITY\SYSTEM</Data>
<Binary>000007800000000000 0000000000 0000000000 0000000000 0000000000 0000000000 0000000000 00</Binary >
</EventData>
</Event>
Second :
Log Name: System
Source: Microsoft-Windows-Wininit
Date: 11/12/2013 9:44:56 AM
Event ID: 11
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: TestXen.federated.fds
Description:
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wi ninit" Guid="{206F6DEA-D3C5-4D10- BC72-989F0 3C8B84B}" />
<EventID>11</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x40000000000000 00</Keywor ds>
<TimeCreated SystemTime="2013-11-12T17: 44:56.5100 40400Z" />
<EventRecordID>6317</Event RecordID>
<Correlation />
<Execution ProcessID="756" ThreadID="812" />
<Channel>System</Channel>
<Computer>TestXen.federate d.fds</Com puter>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="StringCount">1</Data >
<Data Name="String">C:\PROGRA~2\ Citrix\Sys tem32\mfap hook64.dll </Data>
</EventData>
</Event>
I have test server which is holding Xenapp roles and it's Vm server hosted in VMWARE.
Since last week friday ,My server is being turned off automatically...
While analyzing the log i found the following events..can some please help me on this.
Also,am using a trail version of Win 2008 R2 server..
Events:
This is the showing repeatedly whenver the turn off occurs
Log Name: System
Source: USER32
Date: 11/11/2013 6:01:10 PM
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: TestXen.federated.fds
Description:
The process wininit.exe (127.0.0.1) has initiated the power off of computer TESTXEN on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shutdown Type: power off
Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="USER32" />
<EventID Qualifiers="32768">1074</E
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2013-11-12T02:
<EventRecordID>6213</Event
<Channel>System</Channel>
<Computer>TestXen.federate
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>wininit.exe (127.0.0.1)</Data>
<Data>TESTXEN</Data>
<Data>Legacy API shutdown</Data>
<Data>0x80070000</Data>
<Data>power off</Data>
<Data>
</Data>
<Data>NT AUTHORITY\SYSTEM</Data>
<Binary>000007800000000000
</EventData>
</Event>
Second :
Log Name: System
Source: Microsoft-Windows-Wininit
Date: 11/12/2013 9:44:56 AM
Event ID: 11
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: TestXen.federated.fds
Description:
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wi
<EventID>11</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x40000000000000
<TimeCreated SystemTime="2013-11-12T17:
<EventRecordID>6317</Event
<Correlation />
<Execution ProcessID="756" ThreadID="812" />
<Channel>System</Channel>
<Computer>TestXen.federate
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="StringCount">1</Data
<Data Name="String">C:\PROGRA~2\
</EventData>
</Event>
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hi guys,
Thanks for you participation..I found out the answer by myself....As mentioned above My trail version got expired which is intiating the shutdown every one hr...
Once i ran a command slmmgr to extend the trail and it worked and no more the server is rebooting ...thank you again..
Thanks for you participation..I found out the answer by myself....As mentioned above My trail version got expired which is intiating the shutdown every one hr...
Once i ran a command slmmgr to extend the trail and it worked and no more the server is rebooting ...thank you again..
ASKER
Thanks for you participation..I found out the answer by myself....As mentioned above My trail version got expired which is intiating the shutdown every one hr...
Once i ran a command slmmgr to extend the trail and it worked and no more the server is rebooting ...thank you again..