• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2942
  • Last Modified:

Trapping why Windows Server reboots randomly

Hello Experts,   I have a server that continues to reboot randomly.  I wiped out the OS and reinstalled all of the software.  It is a RDS (terminal service) server.

Is there a way to trap what is causing it to reboot?

I suspect a driver is causing the issue as the hardware checks out via manufacturer diagnostics.
0
tucktech
Asked:
tucktech
4 Solutions
 
Andy MInternal Systems ManagerCommented:
First port of call would be check the event logs - it should give you an idea of what was happening around the time of the reboot and what initiated it (if it was  proper reboot).

If it's a bluescreen event you should have a memory dump which can be checked for information on what may have caused it as well. (If it's a driver this should point towards it).

Another option would be to setup some performance monitors - see if anything shows up around the time of the reboots.

If none of these show anything it could indicate a power issue - faulty PSU/plug/someone switching it off?
0
 
tucktechAuthor Commented:
The only thing I see in the event logs for application and system are events after the system started up stating the shutdown was unexpected.

Where can I find the dump logs?

Also, with the hardware checks it did check the PSU and it appears to be ok.
0
 
tmoore1962Commented:
First run a memory / hard drive test on the server since you have reloaded it.  Make sure you run the memory test several passes if reboots are random.  Even if memory test successfully completes several passes, I'd at least reseat memory (use a pencil eraser to clean the memory contacts - remember static control - especially if svr in area where temp/humid varies.  I'd also check the voltages either using Bios or CPUid hardware monitor.  You can also blow out fans / heat sinks if they look like they need it when you reseat mem.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Ratnesh MishraCommented:
Look for " Event id : 1074 Source : USER32 " in System log . This will give you the process name with reason. Also which account is used for it. Apart from this if you start audit log ,that will also help you a lot.
0
 
tucktechAuthor Commented:
tmoore1962, I have run hardware diagnostics, but you are correct, I have had bad memory play funny tricks unless extensive diagnostics are run to validate there is nothing wrong.  I will run memory diagnostics.

 Ratnesh Mishra, below are some logs, the interesting thing is that I don't have a 1074 fot the time around the unexpected restart.  Also, how do I setup audit log?

Log Name:      System
Source:        USER32
Date:          1/29/2014 12:11:44 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      CC5.cc.ad
Description:
The process msiexec.exe has initiated the restart of computer CC5 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80030002
 Shutdown Type: restart
 Comment: The Windows Installer initiated a system restart to complete or continue the configuration of ''.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-29T06:11:44.000000000Z" />
    <EventRecordID>9068</EventRecordID>
    <Channel>System</Channel>
    <Computer>CC5.cc.ad</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>msiexec.exe</Data>
    <Data>CC5</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x80030002</Data>
    <Data>restart</Data>
    <Data>The Windows Installer initiated a system restart to complete or continue the configuration of ''.</Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Binary>02000380000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        USER32
Date:          1/29/2014 12:00:09 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          CC\administrator
Computer:      CC5.cc.ad
Description:
The process C:\Windows\System32\shutdown.exe (CC5) has initiated the restart of computer CC5 on behalf of user CC\Administrator for the following reason: No title for this reason could be found
 Reason Code: 0x800000ff
 Shutdown Type: restart
 Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-29T06:00:09.000000000Z" />
    <EventRecordID>8814</EventRecordID>
    <Channel>System</Channel>
    <Computer>CC5.cc.ad</Computer>
    <Security UserID="S-1-5-21-3111841159-2826495398-1470007349-500" />
  </System>
  <EventData>
    <Data>C:\Windows\System32\shutdown.exe (CC5)</Data>
    <Data>CC5</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x800000ff</Data>
    <Data>restart</Data>
    <Data>
    </Data>
    <Data>CC\Administrator</Data>
    <Binary>FF000080000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        USER32
Date:          1/28/2014 11:42:20 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      CC5.cc.ad
Description:
The process msiexec.exe has initiated the restart of computer CC5 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80030002
 Shutdown Type: restart
 Comment: The Windows Installer initiated a system restart to complete or continue the configuration of 'NComputing vSpace Server for Windows'.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-29T05:42:20.000000000Z" />
    <EventRecordID>8566</EventRecordID>
    <Channel>System</Channel>
    <Computer>CC5.cc.ad</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>msiexec.exe</Data>
    <Data>CC5</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x80030002</Data>
    <Data>restart</Data>
    <Data>The Windows Installer initiated a system restart to complete or continue the configuration of 'NComputing vSpace Server for Windows'.</Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Binary>02000380000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>



Log Name:      System
Source:        EventLog
Date:          1/29/2014 7:45:48 AM
Event ID:      6008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      CC5.cc.ad
Description:
The previous system shutdown at 7:41:30 AM on ¿1/¿29/¿2014 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6008</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-29T13:45:48.000000000Z" />
    <EventRecordID>9429</EventRecordID>
    <Channel>System</Channel>
    <Computer>CC5.cc.ad</Computer>
    <Security />
  </System>
  <EventData>
    <Data>7:41:30 AM</Data>
    <Data>¿1/¿29/¿2014</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>26800</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>DE07010003001D00070029001E009902DE07010003001D000D0029001E0099023C0000003C000000000000000000000000000000000000000100000000000000</Binary>
  </EventData>
</Event>
0
 
tucktechAuthor Commented:
this was my own comment back, not required for providing points to self.
0
 
tucktechAuthor Commented:
The event logs never pointed to a specific issue.  A good memory check pointed out a hardware issue, memory.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Tackle projects and never again get stuck behind a technical roadblock.
Join Now