Solved

Windows 2012 R2 Random Reboots (wininit.exe initiated restart...)

Posted on 2014-03-05
10
7,862 Views
Last Modified: 2014-03-26
Brought up a couple of virtual DCs, on W2012 St R2.  Used the VMWare customization process (mistake) and noticed the machines were rebooting with this "wininit.exe" message citing "no real good reason".  I thought it was the VMWare network driver or the customization but then brought up a physical (on Proliant DL380 G6) and the same thing happened.  There is no real good info out there on this- so before I "buck up" and call Microsoft I figured I'd try the trusty ole EE. Thoughts?
------------------------------------Event ID 1074  Source: User32--------------

The process wininit.exe has initiated the restart of computer SERVERNAME on behalf of user  for the following reason: No title for this reason could be found
 Reason Code: 0x50006
 Shutdown Type: restart
 Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819.  The system will now shut down and restart.
0
Comment
Question by:mcburn13
10 Comments
 
LVL 1

Author Comment

by:mcburn13
ID: 39907858
This seems to be related- but I can't find a 2012 R2 version of this hotfix:
http://support.microsoft.com/kb/2732595/en-us
0
 
LVL 57

Expert Comment

by:Cliff Galiher
ID: 39907859
HP does not support 2012 R2 on the DL380 G6, and since it isn't certificate for 2012 R2, I can tell you MS support will pretty much end up telling you the same thing. The architectural changes in storage and networking are the primary culprit and it'd take some firmware changes to resolve the outstanding issues. Since the G6 is officially legacy hardware, I'd not hold my breath for 2012 R2 support to get added.
0
 
LVL 1

Author Comment

by:mcburn13
ID: 39907876
Well I would say they'd support 2012 R2 on ESX 5.5 which two of my machines are on...I'm guessing whatever the fix is for one will be for the other as it is the same exact symptom.

I am noticing a pattern of access denied messages from machines on a broken trust though- perhaps they are crashing lsass.exe, hmmm.
0
Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

 
LVL 4

Expert Comment

by:aa-denver
ID: 39907880
What version of vmware are you using?  We are using ver 5 and have had no problems with 2012 R2 vms rebooting.   We did have a vm NIC issue and are using the vmxnet3 virtual adapter rather than the E1000.  Have you tried that?  I'm assuming you have vmware tools installed.
0
 

Expert Comment

by:CraigHerbert25
ID: 39907906
Do you have a licenses? I remember that Windows Server 2008 R2 used to shutdown after 24 hours due to no license. How quickly does the reboot occur?
0
 
LVL 1

Author Comment

by:mcburn13
ID: 39908783
Servers are activated- the VMs have the VMtools installed, using the VMware NIC, on ESX 5.5.  As the same thing is happening on a new physical server I don't think the problem is VMware-related.
0
 
LVL 1

Author Comment

by:mcburn13
ID: 39909727
one other thing I originally thought was WMware related possibly was setting this error close to the reboot error: A TDI filter (\Driver\vnetflt) was detected. This filter has not been certified by Microsoft and may cause system instability.

But again this is happening on a physical so...

not sure if it is related but I am seeing messages like this also close to time of the restart.  Since it is lsass.exe crashing- perhaps somehow these unauthorized machine accounts are overloading this AD service?

The session setup from the computer COMPUTERNAME failed to authenticate. The following error occurred:
Access is denied.
or
The session setup from computer 'COMPUTERNAME' failed because the security database does not contain a trust account 'COMPUTERNAME$' referenced by the specified computer.
0
 
LVL 1

Assisted Solution

by:mcburn13
mcburn13 earned 0 total points
ID: 39909918
Well it looks like it may be a bug with Microsoft when object auditing is enabled on an R2 domain controller.  There is a patch you have to call them for KB 2914387  (you won't find it at this point have to call)

See the thread here
0
 
LVL 1

Accepted Solution

by:
mcburn13 earned 0 total points
ID: 39923738
Looks like they just released the patch yesterday. I'm installing it on one 2012 R2 Dc and will report back as I can usually trigger the reboot by renaming objects a few times.

MS Patch: http://support.microsoft.com/kb/2928680/en-us
0
 
LVL 1

Author Closing Comment

by:mcburn13
ID: 39936351
Was a patch that was in the wild and released by Microsoft on 3/10/14
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question