Environment is Vmware hosts running 400 VMs (windows 7) and Citrix XenDesktop so users can connect to their VMs thru a browser.
I have noticed that a lot of the VMs are power off at different times and I don't know why. The logs are riddled with 1074 events initiated by winlogon.exe and explorer.exe on behalf of the user who is logged on. The odd one is:
The process C:\Windows\system32\winlogon.exe (CDP-COSU114) has initiated the power off of computer CDP-COSU114 on behalf of user ABC_domain\Faith_Jones for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: power off
We have confirmed that the Citrix Controller is NOT doing this.
We have confirmed that the Vmware hosts are not doing this.
I'm looking for other places to look for dead bodies. Anyone have any thoughts on this?