Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

VMs with 1074 events and mysterious power off

Posted on 2016-09-01
5
Medium Priority
?
91 Views
Last Modified: 2016-09-09
Environment is Vmware hosts running 400 VMs (windows 7) and Citrix XenDesktop so users can connect to their VMs thru a browser.  

I have noticed that a lot of the VMs are power off at different times and I don't know why.  The logs are riddled with 1074 events initiated by winlogon.exe and explorer.exe on behalf of the user who is logged on.  The odd one is:

The process C:\Windows\system32\winlogon.exe (CDP-COSU114) has initiated the power off of computer CDP-COSU114 on behalf of user ABC_domain\Faith_Jones for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:

We have confirmed that the Citrix Controller is NOT doing this.  

We have confirmed that the Vmware hosts are not doing this.

I'm looking for other places to look for dead bodies.  Anyone have any thoughts on this?

Thanks

Cliff
0
Comment
Question by:crp0499
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 41780660
Likely that folks are hitting the shutdown option when trying to log off, if they're getting full desktops.

Create a group policy that removes the power off option except for designated admins.
0
 

Author Comment

by:crp0499
ID: 41780874
We tried that, but removing the power off means no restart either and they need to be able to restart.
0
 
LVL 28

Expert Comment

by:asavener
ID: 41781515
Can you give them a reboot option on the portal, but not inside the OS?
0
 

Author Comment

by:crp0499
ID: 41782273
Inside the portal?  what do you mean?
0
 
LVL 26

Accepted Solution

by:
Tony J earned 2000 total points
ID: 41784722
Well assuming it's users just hitting the power off button in their VDI desktop, why not just change that to reboot?

Win 7 introduced this as a GPO:

User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Change Start Menu power button

You can then set the default option here to Restart. Granted this doesn't stop them shutting the machine down if they really want to, but it does minimise the chances as they have to think about what they're doing.

Alternatively, you could use GPO to remove the option to shutdown, then deliver a shortcut to shutdown /r /f /t 0 and call it "Restart machine".

I do accept that neither of these are the most seamless options.
0

Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
In this article we will learn how to backup a VMware farm using Nakivo Backup & Replication. In this tutorial we will install the software on a Windows 2012 R2 Server.
Teach the user how to use create log bundles for vCenter Server or ESXi hosts Open vSphere Web Client: Generate vCenter Server and ESXi host log bundle:  Open vCenter Server Appliance Web Management interface and generate log bundle: Open vCenter Se…
This Micro Tutorial steps you through the configuration steps to configure your ESXi host Management Network settings and test the management network, ensure the host is recognized by the DNS Server, configure a new password, and the troubleshooting…

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question