Solved

VMs with 1074 events and mysterious power off

Posted on 2016-09-01
5
73 Views
Last Modified: 2016-09-09
Environment is Vmware hosts running 400 VMs (windows 7) and Citrix XenDesktop so users can connect to their VMs thru a browser.  

I have noticed that a lot of the VMs are power off at different times and I don't know why.  The logs are riddled with 1074 events initiated by winlogon.exe and explorer.exe on behalf of the user who is logged on.  The odd one is:

The process C:\Windows\system32\winlogon.exe (CDP-COSU114) has initiated the power off of computer CDP-COSU114 on behalf of user ABC_domain\Faith_Jones for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:

We have confirmed that the Citrix Controller is NOT doing this.  

We have confirmed that the Vmware hosts are not doing this.

I'm looking for other places to look for dead bodies.  Anyone have any thoughts on this?

Thanks

Cliff
0
Comment
Question by:crp0499
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 41780660
Likely that folks are hitting the shutdown option when trying to log off, if they're getting full desktops.

Create a group policy that removes the power off option except for designated admins.
0
 

Author Comment

by:crp0499
ID: 41780874
We tried that, but removing the power off means no restart either and they need to be able to restart.
0
 
LVL 28

Expert Comment

by:asavener
ID: 41781515
Can you give them a reboot option on the portal, but not inside the OS?
0
 

Author Comment

by:crp0499
ID: 41782273
Inside the portal?  what do you mean?
0
 
LVL 25

Accepted Solution

by:
Tony Johncock earned 500 total points
ID: 41784722
Well assuming it's users just hitting the power off button in their VDI desktop, why not just change that to reboot?

Win 7 introduced this as a GPO:

User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Change Start Menu power button

You can then set the default option here to Restart. Granted this doesn't stop them shutting the machine down if they really want to, but it does minimise the chances as they have to think about what they're doing.

Alternatively, you could use GPO to remove the option to shutdown, then deliver a shortcut to shutdown /r /f /t 0 and call it "Restart machine".

I do accept that neither of these are the most seamless options.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Centos 6.5 Install On VMware Workstation 12 Problem 46 84
VMware ESXI running on Dell server - Server Crash Scenario 3 80
Separating Management Network 6 82
ESXi NTP 4 60
HOW TO: Upload an ISO image to a VMware datastore for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere Host Client, and checking its MD5 checksum signature is correct.  It's a good idea to compare checksums, because many installat…
In this article, I show you step by step with screenshots to assist you - HOW TO: Deploy and Install the VMware vCenter Server Appliance 6.5 (VCSA 6.5), with some helpful tips along the way.
Teach the user how to rename, unmount, delete and upgrade VMFS datastores. Open vSphere Web Client: Rename VMFS and NFS datastores: Upgrade VMFS-3 volume to VMFS-5: Unmount VMFS datastore: Delete a VMFS datastore:
Teach the user how to use create log bundles for vCenter Server or ESXi hosts Open vSphere Web Client: Generate vCenter Server and ESXi host log bundle:  Open vCenter Server Appliance Web Management interface and generate log bundle: Open vCenter Se…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question