How to tell why the Win2003 servers shut down?

I have about three 2008 servers and five 2003 servers. Two of 2003 servers (one is AD) got shut down by themselves last night sometime after about 11:30pm. I didn't notice until this morning. I successfully booted them back without any error or message in the Event Viewer. So I'm still puzzled about the reason of their shutdown. All other servers connecting to the same UPS are just running without interruption.
Can you help figure out?
CastlewoodAsked:
Who is Participating?
 
VB ITSConnect With a Mentor Specialist ConsultantCommented:
Have a look at the System log in Event Viewer for event ID 1074 as this will tell you what application or user has initiated the shut down.

More information for this event can be found here: http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=1074&EvtSrc=User32&LCID=1033

If you can't figure it out from the log, post the contents of this event ID here for us to review.
0
 
Mark GalvinConnect With a Mentor Managing Director / Principal ConsultantCommented:
Windows Update? Hardware issue? Over heating?
0
 
v_2abhis2Connect With a Mentor Commented:
Look for event ID 6008 in system Logs  or Event ID 1074, This would tell you if the system crashed or it was rebooted, then from there build your analysis by looking at the events logged before these 2 events.
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
CastlewoodAuthor Commented:
I did find both 2003 servers have event ID 6008 in their system log. There is no 1074.
What mostly surprises me is both shutdown time is just 30 seconds away. How could that happen?? I'm pretty sure that was not caused by Windows Update because it is configured to update manually instead of automatically for these two servers.
This really puzzles me. What do you think?
0
 
v_2abhis2Commented:
Check for minidump file that is usually configured on the system and is located at c:\windows\minidump and follow the following KB article to analyze the issue for the system crash

Microsoft KB article number 315263
0
 
CastlewoodAuthor Commented:
I found only one file mini101008-01.dmp dated 10-10-2008 which obviously is not by the recent shutdown event.
Why could the two servers shut down by themselves within just 30 seconds away?
0
 
CastlewoodAuthor Commented:
You wouldn't believe this...
It ends up to be the UPS. Here is the catch: there are multiple separate module in the UPS. The black-out just happened to be the module where my two 2003 servers plugged into, while others remained normal.
This is so rare.
0
 
VB ITSSpecialist ConsultantCommented:
Rare indeed, but it does happen. Glad you were able to find out the cause of the issue.

At least now you can troubleshoot these sort of problems if it does ever happen again! :)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.