Solved

Windows 2012 R2 Random Reboots (wininit.exe initiated restart...)

Posted on 2014-03-05
10
7,231 Views
Last Modified: 2014-03-26
Brought up a couple of virtual DCs, on W2012 St R2.  Used the VMWare customization process (mistake) and noticed the machines were rebooting with this "wininit.exe" message citing "no real good reason".  I thought it was the VMWare network driver or the customization but then brought up a physical (on Proliant DL380 G6) and the same thing happened.  There is no real good info out there on this- so before I "buck up" and call Microsoft I figured I'd try the trusty ole EE. Thoughts?
------------------------------------Event ID 1074  Source: User32--------------

The process wininit.exe has initiated the restart of computer SERVERNAME on behalf of user  for the following reason: No title for this reason could be found
 Reason Code: 0x50006
 Shutdown Type: restart
 Comment: The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819.  The system will now shut down and restart.
0
Comment
Question by:mcburn13
10 Comments
 
LVL 1

Author Comment

by:mcburn13
ID: 39907858
This seems to be related- but I can't find a 2012 R2 version of this hotfix:
http://support.microsoft.com/kb/2732595/en-us
0
 
LVL 56

Expert Comment

by:Cliff Galiher
ID: 39907859
HP does not support 2012 R2 on the DL380 G6, and since it isn't certificate for 2012 R2, I can tell you MS support will pretty much end up telling you the same thing. The architectural changes in storage and networking are the primary culprit and it'd take some firmware changes to resolve the outstanding issues. Since the G6 is officially legacy hardware, I'd not hold my breath for 2012 R2 support to get added.
0
 
LVL 1

Author Comment

by:mcburn13
ID: 39907876
Well I would say they'd support 2012 R2 on ESX 5.5 which two of my machines are on...I'm guessing whatever the fix is for one will be for the other as it is the same exact symptom.

I am noticing a pattern of access denied messages from machines on a broken trust though- perhaps they are crashing lsass.exe, hmmm.
0
 
LVL 4

Expert Comment

by:aa-denver
ID: 39907880
What version of vmware are you using?  We are using ver 5 and have had no problems with 2012 R2 vms rebooting.   We did have a vm NIC issue and are using the vmxnet3 virtual adapter rather than the E1000.  Have you tried that?  I'm assuming you have vmware tools installed.
0
 

Expert Comment

by:CraigHerbert25
ID: 39907906
Do you have a licenses? I remember that Windows Server 2008 R2 used to shutdown after 24 hours due to no license. How quickly does the reboot occur?
0
 
LVL 1

Author Comment

by:mcburn13
ID: 39908783
Servers are activated- the VMs have the VMtools installed, using the VMware NIC, on ESX 5.5.  As the same thing is happening on a new physical server I don't think the problem is VMware-related.
0
 
LVL 1

Author Comment

by:mcburn13
ID: 39909727
one other thing I originally thought was WMware related possibly was setting this error close to the reboot error: A TDI filter (\Driver\vnetflt) was detected. This filter has not been certified by Microsoft and may cause system instability.

But again this is happening on a physical so...

not sure if it is related but I am seeing messages like this also close to time of the restart.  Since it is lsass.exe crashing- perhaps somehow these unauthorized machine accounts are overloading this AD service?

The session setup from the computer COMPUTERNAME failed to authenticate. The following error occurred:
Access is denied.
or
The session setup from computer 'COMPUTERNAME' failed because the security database does not contain a trust account 'COMPUTERNAME$' referenced by the specified computer.
0
 
LVL 1

Assisted Solution

by:mcburn13
mcburn13 earned 0 total points
ID: 39909918
Well it looks like it may be a bug with Microsoft when object auditing is enabled on an R2 domain controller.  There is a patch you have to call them for KB 2914387  (you won't find it at this point have to call)

See the thread here
0
 
LVL 1

Accepted Solution

by:
mcburn13 earned 0 total points
ID: 39923738
Looks like they just released the patch yesterday. I'm installing it on one 2012 R2 Dc and will report back as I can usually trigger the reboot by renaming objects a few times.

MS Patch: http://support.microsoft.com/kb/2928680/en-us
0
 
LVL 1

Author Closing Comment

by:mcburn13
ID: 39936351
Was a patch that was in the wild and released by Microsoft on 3/10/14
0

Join & Write a Comment

Synchronize a new Active Directory domain with an existing Office 365 tenant
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
In this Micro Tutorial viewers will learn how they can get their files copied out from their unbootable system without need to use recovery services. As an example non-bootable Windows 2012R2 installation is used which has boot problems.
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now