Solved

Why is my Windows 2008 R2 Server restarting at same time every night?

Posted on 2014-11-10
13
794 Views
Last Modified: 2015-06-28
At my place of work we have two Windows 2008 R2 servers, and one of them has started to restart itself every night at 12:13:14 AM. There are no scheduled tasks that could be causing this, nor is it a Windows Update restart.

The machine is virus free (although it has previously been infected with Conficker and FTP.bat), and so I can't see what it would be that is causing it.

It seems to be a very clean shutdown, so it's not doing any harm, but it's been causing me such grief over the past couple of weeks.

This is what I found in Event Viewer.

GENERAL TAB:
The process C:\Windows\system32\shutdown.exe (**name**) has initiated the restart of computer **name** on behalf of user NT AUTHORITYNETWORK SERVICE for the following reason: No title for this reason could be found
 Reason Code: 0x800000ff
 Shutdown Type: restart
 Comment:
0
Comment
Question by:LukeHarrison
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +3
13 Comments
 
LVL 16

Expert Comment

by:DcpKing
ID: 40432530
Check out MS' info about shutdowns here. There should be a file in the %windir%\system32\LogFiles\Shutdown\ directory with info about the shutdown, telling what's running at the time.

hth

Mike
0
 
LVL 4

Expert Comment

by:hulsebosch
ID: 40432531
Have you checked your taskmanager ?
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 40432773
Whats recorded in the event log for the shutdown? It should record what requested the shutdown and from where.
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:LukeHarrison
ID: 40434471
I don't seem to have the %windir%\system32\LogFiles\Shutdown\ directory. Goes as far as LogFiles but there's no Shutdown folder in there.

The only thing I can see that requested the shutdown is NT AUTHORITY\SYSTEM from C:\Windows\system32\shutdown.exe or C:\Windows\SysWOW64\shutdown.exe.
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40434831
Have you checked that you don't have some program scheduled in the task scheduler at about the time that the computer shuts down? If you do, change its scheduling and see if the shutdown time changes ...
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40435003
Do you run WSUS?
when are windows updates applied?
How are they applied?
What is running on this server?


"Taken from Microsoft"

""Method 1:

 

It might be some third party application is causing this issue. Put the system in clean boot. Follow the steps mentioned in the article given below to configure the system in clean boot and check.

 

How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

http://support.microsoft.com/kb/929135     

 

Note: After you have finished installing, follow step 7 in the article to boot to normal startup.

 

 

Method 2:

 

Also check the power options if your computer is configured to shut down in case of inactivity.

a. Open Power Options by clicking the Start button , clicking Control Panel, clicking System and Maintenance, and then clicking Power Options.
b. On the Select a power plan page, click Change plan settings under the selected plan.
c. On the Change settings for the plan page, click Change advanced power settings.
d. On the Advanced settings tab, expand Power buttons and lid, expand Start menu power button, and then do one of the following:

click On battery or Plugged in (or both), click the arrow, and then click Sleep, Hibernate, or Shut Down.

If you are using a desktop computer, click Setting, click the arrow, and then click Sleep, Hibernate, or Shut Down.
e. Click OK, and then click Save changes.

Here are the articles that should give you more information about this:

http://windows.microsoft.com/en-us/windows7/Turn-off-a-computer-frequently-asked-questions

http://windows.microsoft.com/en-us/windows7/Change-create-or-delete-a-power-plan-scheme
""
0
 

Author Comment

by:LukeHarrison
ID: 40435176
Thank you all for your assistance. I have now got this sorted thanks to a private message.

Thanks all.
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40435662
Luke,
What was the solution?
Curiosity..
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40436405
Great to hear that you found the problem.

Rob is right. Please explain what it was that fixed it.
Many people come here looking for answers and only ask questions when they can't find their problem already answered. Explaining the fix will help others.

Mike
0
 

Accepted Solution

by:
LukeHarrison earned 0 total points
ID: 40436742
The previous infections I had removed had added a few randomly named jobs in my MS SQL installation, one of which was to call a reboot at that time every night.  Using SSMS I was able to find and remove these jobs, and I can confirm that the server didn't reboot last night.

Many thanks
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40439139
Thanks for explaining! Now others will have another clue about what to look for!
0
 
LVL 35

Expert Comment

by:Seth Simmons
ID: 40855319
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
This article helps those who get the 0xc004d307 error when trying to rearm (reset the license) Office 2013 in a Virtual Desktop Infrastructure (VDI) and/or those trying to prep the master image for Microsoft Key Management (KMS) activation. (i.e.- C…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Suggested Courses

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question