Guest Raman Posted November 29, 2007 Posted November 29, 2007 One of our server has been shutdown unknowingly, I was investigating, which account is responsible for that. There was a clean shutdown of the system at specific time (event IDs 6005 and 6006 suggest this; also, there is no event ID 6008 which would indicate a "dirty" shutdown). The user logoff event (event ID 538) immediately preceding the system shutdown event, is not matching with any of the user logon events (event ID 528). Kindly advice is there any other way we can find the culprit (in windows 2000 server). Thanks, Raman
Guest Dave Patrick Posted November 29, 2007 Posted November 29, 2007 Re: shutdown unknowingly! If no BSOD's occur (Event ID: 1001 Source: Save Dump), then it may be a power problem. I would look at a possible faulty (or undersized) pc power supply, UPS, bad battery, or the circuit feeding the outlet that the pc is plugged into. Also check the cmos setup power settings. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "Raman" wrote: > One of our server has been shutdown unknowingly, I was investigating, > which account is responsible for that. > > > > There was a clean shutdown of the system at specific time (event IDs 6005 > and 6006 suggest this; also, there is no event ID 6008 which would > indicate a "dirty" shutdown). The user logoff event (event ID 538) > immediately preceding the system shutdown event, is not matching with any > of the user logon events (event ID 528). > > > > Kindly advice is there any other way we can find the culprit (in windows > 2000 server). > > > > Thanks, > > > > Raman > >
Guest Raman Posted November 29, 2007 Posted November 29, 2007 Re: shutdown unknowingly! As I've mentioned early, No BSOD /No Memory.dmp, it's a clean shutdown of the system at specific time. Here I'm trying to find who has logged in to the server during that time. Thanks, -Raman "Dave Patrick" <DSPatrick@nospam.gmail.com> wrote in message news:640D1C52-0CA2-4394-BE09-15921C518E56@microsoft.com... > If no BSOD's occur (Event ID: 1001 Source: Save Dump), then it may be a > power problem. I would look at a possible faulty (or undersized) pc power > supply, UPS, bad battery, or the circuit feeding the outlet that the pc is > plugged into. > > Also check the cmos setup power settings. > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "Raman" wrote: >> One of our server has been shutdown unknowingly, I was investigating, >> which account is responsible for that. >> >> >> >> There was a clean shutdown of the system at specific time (event IDs 6005 >> and 6006 suggest this; also, there is no event ID 6008 which would >> indicate a "dirty" shutdown). The user logoff event (event ID 538) >> immediately preceding the system shutdown event, is not matching with any >> of the user logon events (event ID 528). >> >> >> >> Kindly advice is there any other way we can find the culprit (in windows >> 2000 server). >> >> >> >> Thanks, >> >> >> >> Raman >> >> >
Guest Dave Patrick Posted November 30, 2007 Posted November 30, 2007 Re: shutdown unknowingly! This link may help. http://technet2.microsoft.com/windowsserver/en/library/e104c96f-e243-41c5-aaea-d046555a079d1033.mspx?mfr=true -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "Raman" wrote: > As I've mentioned early, No BSOD /No Memory.dmp, it's a clean shutdown of > the system at specific time. Here I'm trying to find who has logged in to > the server during that time. > > > Thanks, > > -Raman
Recommended Posts