Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Why is my Windows 2008 R2 Server restarting at same time every night?

Posted on 2014-11-10
13
Medium Priority
?
985 Views
Last Modified: 2015-06-28
At my place of work we have two Windows 2008 R2 servers, and one of them has started to restart itself every night at 12:13:14 AM. There are no scheduled tasks that could be causing this, nor is it a Windows Update restart.

The machine is virus free (although it has previously been infected with Conficker and FTP.bat), and so I can't see what it would be that is causing it.

It seems to be a very clean shutdown, so it's not doing any harm, but it's been causing me such grief over the past couple of weeks.

This is what I found in Event Viewer.

GENERAL TAB:
The process C:\Windows\system32\shutdown.exe (**name**) has initiated the restart of computer **name** on behalf of user NT AUTHORITYNETWORK SERVICE for the following reason: No title for this reason could be found
 Reason Code: 0x800000ff
 Shutdown Type: restart
 Comment:
0
Comment
Question by:LukeHarrison
  • 4
  • 3
  • 2
  • +3
13 Comments
 
LVL 16

Expert Comment

by:DcpKing
ID: 40432530
Check out MS' info about shutdowns here. There should be a file in the %windir%\system32\LogFiles\Shutdown\ directory with info about the shutdown, telling what's running at the time.

hth

Mike
0
 
LVL 4

Expert Comment

by:hulsebosch
ID: 40432531
Have you checked your taskmanager ?
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 40432773
Whats recorded in the event log for the shutdown? It should record what requested the shutdown and from where.
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:LukeHarrison
ID: 40434471
I don't seem to have the %windir%\system32\LogFiles\Shutdown\ directory. Goes as far as LogFiles but there's no Shutdown folder in there.

The only thing I can see that requested the shutdown is NT AUTHORITY\SYSTEM from C:\Windows\system32\shutdown.exe or C:\Windows\SysWOW64\shutdown.exe.
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40434831
Have you checked that you don't have some program scheduled in the task scheduler at about the time that the computer shuts down? If you do, change its scheduling and see if the shutdown time changes ...
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40435003
Do you run WSUS?
when are windows updates applied?
How are they applied?
What is running on this server?


"Taken from Microsoft"

""Method 1:

 

It might be some third party application is causing this issue. Put the system in clean boot. Follow the steps mentioned in the article given below to configure the system in clean boot and check.

 

How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

http://support.microsoft.com/kb/929135     

 

Note: After you have finished installing, follow step 7 in the article to boot to normal startup.

 

 

Method 2:

 

Also check the power options if your computer is configured to shut down in case of inactivity.

a. Open Power Options by clicking the Start button , clicking Control Panel, clicking System and Maintenance, and then clicking Power Options.
b. On the Select a power plan page, click Change plan settings under the selected plan.
c. On the Change settings for the plan page, click Change advanced power settings.
d. On the Advanced settings tab, expand Power buttons and lid, expand Start menu power button, and then do one of the following:

click On battery or Plugged in (or both), click the arrow, and then click Sleep, Hibernate, or Shut Down.

If you are using a desktop computer, click Setting, click the arrow, and then click Sleep, Hibernate, or Shut Down.
e. Click OK, and then click Save changes.

Here are the articles that should give you more information about this:

http://windows.microsoft.com/en-us/windows7/Turn-off-a-computer-frequently-asked-questions

http://windows.microsoft.com/en-us/windows7/Change-create-or-delete-a-power-plan-scheme
""
0
 

Author Comment

by:LukeHarrison
ID: 40435176
Thank you all for your assistance. I have now got this sorted thanks to a private message.

Thanks all.
0
 
LVL 6

Expert Comment

by:Rob G
ID: 40435662
Luke,
What was the solution?
Curiosity..
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40436405
Great to hear that you found the problem.

Rob is right. Please explain what it was that fixed it.
Many people come here looking for answers and only ask questions when they can't find their problem already answered. Explaining the fix will help others.

Mike
0
 

Accepted Solution

by:
LukeHarrison earned 0 total points
ID: 40436742
The previous infections I had removed had added a few randomly named jobs in my MS SQL installation, one of which was to call a reboot at that time every night.  Using SSMS I was able to find and remove these jobs, and I can confirm that the server didn't reboot last night.

Many thanks
0
 
LVL 16

Expert Comment

by:DcpKing
ID: 40439139
Thanks for explaining! Now others will have another clue about what to look for!
0
 
LVL 36

Expert Comment

by:Seth Simmons
ID: 40855319
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

IF you are either unfamiliar with rootkits, or want to know more about them, read on ....
Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question