Solved

VMs with 1074 events and mysterious power off

Posted on 2016-09-01
5
54 Views
Last Modified: 2016-09-09
Environment is Vmware hosts running 400 VMs (windows 7) and Citrix XenDesktop so users can connect to their VMs thru a browser.  

I have noticed that a lot of the VMs are power off at different times and I don't know why.  The logs are riddled with 1074 events initiated by winlogon.exe and explorer.exe on behalf of the user who is logged on.  The odd one is:

The process C:\Windows\system32\winlogon.exe (CDP-COSU114) has initiated the power off of computer CDP-COSU114 on behalf of user ABC_domain\Faith_Jones for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:

We have confirmed that the Citrix Controller is NOT doing this.  

We have confirmed that the Vmware hosts are not doing this.

I'm looking for other places to look for dead bodies.  Anyone have any thoughts on this?

Thanks

Cliff
0
Comment
Question by:crp0499
  • 2
  • 2
5 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 41780660
Likely that folks are hitting the shutdown option when trying to log off, if they're getting full desktops.

Create a group policy that removes the power off option except for designated admins.
0
 

Author Comment

by:crp0499
ID: 41780874
We tried that, but removing the power off means no restart either and they need to be able to restart.
0
 
LVL 28

Expert Comment

by:asavener
ID: 41781515
Can you give them a reboot option on the portal, but not inside the OS?
0
 

Author Comment

by:crp0499
ID: 41782273
Inside the portal?  what do you mean?
0
 
LVL 25

Accepted Solution

by:
Tony1044 earned 500 total points
ID: 41784722
Well assuming it's users just hitting the power off button in their VDI desktop, why not just change that to reboot?

Win 7 introduced this as a GPO:

User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Change Start Menu power button

You can then set the default option here to Restart. Granted this doesn't stop them shutting the machine down if they really want to, but it does minimise the chances as they have to think about what they're doing.

Alternatively, you could use GPO to remove the option to shutdown, then deliver a shortcut to shutdown /r /f /t 0 and call it "Restart machine".

I do accept that neither of these are the most seamless options.
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Join & Write a Comment

It Is not possible to enable LLDP in vSwitch(at least is not supported by VMware), so in this article we will enable this, and also go trough how to enabled CDP and how to get this information in vSwitches and also in vDS.
This article will show you how to create an ISO CD-ROM/DVD-ROM image (*.iso), and MD5 checksum signature, for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5). It's a good idea to compare checksums, because many installations fail because of a corr…
In this video tutorial I show you the main steps to install and configure  a VMware ESXi6.0 server. The video has my comments as text on the screen and you can pause anytime when needed. Hope this will be helpful. Verify that your hardware and BIO…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now