Solved

Why is my Windows 2008 R2 Server restarting at same time every night?

Posted on 2014-11-10
13
493 Views
Last Modified: 2015-06-28
At my place of work we have two Windows 2008 R2 servers, and one of them has started to restart itself every night at 12:13:14 AM. There are no scheduled tasks that could be causing this, nor is it a Windows Update restart.

The machine is virus free (although it has previously been infected with Conficker and FTP.bat), and so I can't see what it would be that is causing it.

It seems to be a very clean shutdown, so it's not doing any harm, but it's been causing me such grief over the past couple of weeks.

This is what I found in Event Viewer.

GENERAL TAB:
The process C:\Windows\system32\shutdown.exe (**name**) has initiated the restart of computer **name** on behalf of user NT AUTHORITYNETWORK SERVICE for the following reason: No title for this reason could be found
 Reason Code: 0x800000ff
 Shutdown Type: restart
 Comment:
0
Comment
Question by:LukeHarrison
  • 4
  • 3
  • 2
  • +3
13 Comments
 
LVL 16

Expert Comment

by:DcpKing
ID: 40432530
Check out MS' info about shutdowns here. There should be a file in the %windir%\system32\LogFiles\Shutdown\ directory with info about the shutdown, telling what's running at the time.

hth

Mike
0
 
LVL 4

Expert Comment

by:hulsebosch
ID: 40432531
Have you checked your taskmanager ?
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 40432773
Whats recorded in the event log for the shutdown? It should record what requested the shutdown and from where.
0
 

Author Comment

by:LukeHarrison
ID: 40434471
I don't seem to have the %windir%\system32\LogFiles\Shutdown\ directory. Goes as far as LogFiles but there's no Shutdown folder in there.

The only thing I can see that requested the shutdown is NT AUTHORITY\SYSTEM from C:\Windows\system32\shutdown.exe or C:\Windows\SysWOW64\shutdown.exe.
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40434831
Have you checked that you don't have some program scheduled in the task scheduler at about the time that the computer shuts down? If you do, change its scheduling and see if the shutdown time changes ...
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40435003
Do you run WSUS?
when are windows updates applied?
How are they applied?
What is running on this server?


"Taken from Microsoft"

""Method 1:

 

It might be some third party application is causing this issue. Put the system in clean boot. Follow the steps mentioned in the article given below to configure the system in clean boot and check.

 

How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

http://support.microsoft.com/kb/929135    

 

Note: After you have finished installing, follow step 7 in the article to boot to normal startup.

 

 

Method 2:

 

Also check the power options if your computer is configured to shut down in case of inactivity.

a. Open Power Options by clicking the Start button , clicking Control Panel, clicking System and Maintenance, and then clicking Power Options.
b. On the Select a power plan page, click Change plan settings under the selected plan.
c. On the Change settings for the plan page, click Change advanced power settings.
d. On the Advanced settings tab, expand Power buttons and lid, expand Start menu power button, and then do one of the following:

click On battery or Plugged in (or both), click the arrow, and then click Sleep, Hibernate, or Shut Down.

If you are using a desktop computer, click Setting, click the arrow, and then click Sleep, Hibernate, or Shut Down.
e. Click OK, and then click Save changes.

Here are the articles that should give you more information about this:

http://windows.microsoft.com/en-us/windows7/Turn-off-a-computer-frequently-asked-questions

http://windows.microsoft.com/en-us/windows7/Change-create-or-delete-a-power-plan-scheme
""
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:LukeHarrison
ID: 40435176
Thank you all for your assistance. I have now got this sorted thanks to a private message.

Thanks all.
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40435662
Luke,
What was the solution?
Curiosity..
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40436405
Great to hear that you found the problem.

Rob is right. Please explain what it was that fixed it.
Many people come here looking for answers and only ask questions when they can't find their problem already answered. Explaining the fix will help others.

Mike
0
 

Accepted Solution

by:
LukeHarrison earned 0 total points
ID: 40436742
The previous infections I had removed had added a few randomly named jobs in my MS SQL installation, one of which was to call a reboot at that time every night.  Using SSMS I was able to find and remove these jobs, and I can confirm that the server didn't reboot last night.

Many thanks
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40439139
Thanks for explaining! Now others will have another clue about what to look for!
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40855319
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

A procedure for exporting installed hotfix details of remote computers using powershell
In this article, I will show you HOW TO: Install VMware Tools for Windows on a VMware Windows virtual machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, using the VMware Host Client. The virtual machine has Windows Server 2016 instal…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now