Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 10528
  • Last Modified:

Windows 2012 R2 Random Reboots (wininit.exe initiated restart...)

Brought up a couple of virtual DCs, on W2012 St R2.  Used the VMWare customization process (mistake) and noticed the machines were rebooting with this "wininit.exe" message citing "no real good reason".  I thought it was the VMWare network driver or the customization but then brought up a physical (on Proliant DL380 G6) and the same thing happened.  There is no real good info out there on this- so before I "buck up" and call Microsoft I figured I'd try the trusty ole EE. Thoughts?
------------------------------------Event ID 1074  Source: User32--------------

The process wininit.exe has initiated the restart of computer SERVERNAME on behalf of user  for the following reason: No title for this reason could be found
 Reason Code: 0x50006
 Shutdown Type: restart
 Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819.  The system will now shut down and restart.
0
mcburn13
Asked:
mcburn13
2 Solutions
 
mcburn13Author Commented:
This seems to be related- but I can't find a 2012 R2 version of this hotfix:
http://support.microsoft.com/kb/2732595/en-us
0
 
Cliff GaliherCommented:
HP does not support 2012 R2 on the DL380 G6, and since it isn't certificate for 2012 R2, I can tell you MS support will pretty much end up telling you the same thing. The architectural changes in storage and networking are the primary culprit and it'd take some firmware changes to resolve the outstanding issues. Since the G6 is officially legacy hardware, I'd not hold my breath for 2012 R2 support to get added.
0
 
mcburn13Author Commented:
Well I would say they'd support 2012 R2 on ESX 5.5 which two of my machines are on...I'm guessing whatever the fix is for one will be for the other as it is the same exact symptom.

I am noticing a pattern of access denied messages from machines on a broken trust though- perhaps they are crashing lsass.exe, hmmm.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
aa-denverCommented:
What version of vmware are you using?  We are using ver 5 and have had no problems with 2012 R2 vms rebooting.   We did have a vm NIC issue and are using the vmxnet3 virtual adapter rather than the E1000.  Have you tried that?  I'm assuming you have vmware tools installed.
0
 
CraigHerbert25Commented:
Do you have a licenses? I remember that Windows Server 2008 R2 used to shutdown after 24 hours due to no license. How quickly does the reboot occur?
0
 
mcburn13Author Commented:
Servers are activated- the VMs have the VMtools installed, using the VMware NIC, on ESX 5.5.  As the same thing is happening on a new physical server I don't think the problem is VMware-related.
0
 
mcburn13Author Commented:
one other thing I originally thought was WMware related possibly was setting this error close to the reboot error: A TDI filter (\Driver\vnetflt) was detected. This filter has not been certified by Microsoft and may cause system instability.

But again this is happening on a physical so...

not sure if it is related but I am seeing messages like this also close to time of the restart.  Since it is lsass.exe crashing- perhaps somehow these unauthorized machine accounts are overloading this AD service?

The session setup from the computer COMPUTERNAME failed to authenticate. The following error occurred:
Access is denied.
or
The session setup from computer 'COMPUTERNAME' failed because the security database does not contain a trust account 'COMPUTERNAME$' referenced by the specified computer.
0
 
mcburn13Author Commented:
Well it looks like it may be a bug with Microsoft when object auditing is enabled on an R2 domain controller.  There is a patch you have to call them for KB 2914387  (you won't find it at this point have to call)

See the thread here
0
 
mcburn13Author Commented:
Looks like they just released the patch yesterday. I'm installing it on one 2012 R2 Dc and will report back as I can usually trigger the reboot by renaming objects a few times.

MS Patch: http://support.microsoft.com/kb/2928680/en-us
0
 
mcburn13Author Commented:
Was a patch that was in the wild and released by Microsoft on 3/10/14
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now