Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

VMs with 1074 events and mysterious power off

Posted on 2016-09-01
5
Medium Priority
?
99 Views
Last Modified: 2016-09-09
Environment is Vmware hosts running 400 VMs (windows 7) and Citrix XenDesktop so users can connect to their VMs thru a browser.  

I have noticed that a lot of the VMs are power off at different times and I don't know why.  The logs are riddled with 1074 events initiated by winlogon.exe and explorer.exe on behalf of the user who is logged on.  The odd one is:

The process C:\Windows\system32\winlogon.exe (CDP-COSU114) has initiated the power off of computer CDP-COSU114 on behalf of user ABC_domain\Faith_Jones for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:

We have confirmed that the Citrix Controller is NOT doing this.  

We have confirmed that the Vmware hosts are not doing this.

I'm looking for other places to look for dead bodies.  Anyone have any thoughts on this?

Thanks

Cliff
0
Comment
Question by:crp0499
  • 2
  • 2
5 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 41780660
Likely that folks are hitting the shutdown option when trying to log off, if they're getting full desktops.

Create a group policy that removes the power off option except for designated admins.
0
 

Author Comment

by:crp0499
ID: 41780874
We tried that, but removing the power off means no restart either and they need to be able to restart.
0
 
LVL 28

Expert Comment

by:asavener
ID: 41781515
Can you give them a reboot option on the portal, but not inside the OS?
0
 

Author Comment

by:crp0499
ID: 41782273
Inside the portal?  what do you mean?
0
 
LVL 26

Accepted Solution

by:
Tony J earned 2000 total points
ID: 41784722
Well assuming it's users just hitting the power off button in their VDI desktop, why not just change that to reboot?

Win 7 introduced this as a GPO:

User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Change Start Menu power button

You can then set the default option here to Restart. Granted this doesn't stop them shutting the machine down if they really want to, but it does minimise the chances as they have to think about what they're doing.

Alternatively, you could use GPO to remove the option to shutdown, then deliver a shortcut to shutdown /r /f /t 0 and call it "Restart machine".

I do accept that neither of these are the most seamless options.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I show you step by step with screenshots to assist you - HOW TO: Deploy and Install the VMware vCenter Server Appliance 6.5 (VCSA 6.5), with some helpful tips along the way.
A look into Log Analysis and Effective Critical Alerting.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This Micro Tutorial steps you through the configuration steps to configure your ESXi host Management Network settings and test the management network, ensure the host is recognized by the DNS Server, configure a new password, and the troubleshooting…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question