Guest OJG Posted January 17, 2008 Posted January 17, 2008 I have one server that in the last 2-3 weeks has been rebooting at the exact same time every day. It shows this in the event log. Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 1/16/2008 Time: 5:00:47 PM User: NT AUTHORITY\SYSTEM Computer: ******* Description: The process winlogon.exe has initiated the restart of computer CORP-ADP on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown Reason Code: 0x80070000 Shutdown Type: restart Comment: I have checked the AV logs, Landesk tasks and logs and the local task scheduler and can not find any indication of what is causing this. I also ran a full virus and anti spyware scan. Any ideas?
Guest Pegasus \(MVP\) Posted January 17, 2008 Posted January 17, 2008 Re: Server reboots every day same time "OJG" <OJG@discussions.microsoft.com> wrote in message news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com... >I have one server that in the last 2-3 weeks has been rebooting at the >exact > same time every day. It shows this in the event log. > > Event Type: Information > Event Source: USER32 > Event Category: None > Event ID: 1074 > Date: 1/16/2008 > Time: 5:00:47 PM > User: NT AUTHORITY\SYSTEM > Computer: ******* > Description: > The process winlogon.exe has initiated the restart of computer CORP-ADP on > behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API > shutdown > Reason Code: 0x80070000 > Shutdown Type: restart > Comment: > > I have checked the AV logs, Landesk tasks and logs and the local task > scheduler and can not find any indication of what is causing this. I also > ran > a full virus and anti spyware scan. Any ideas? > Since this happens at the exact same time each day, the prime suspect would be some component of a scheduled task. To home in on the culprit, I would move each task by a multiple of 5 minutes: Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes. I expect that the reboot will now happen x minutes later. If it's 10 minutes later then Task2 would be the culprit.
Guest OJG Posted January 17, 2008 Posted January 17, 2008 Re: Server reboots every day same time No luck we moved the two scheduled tasks as suggested and the shutdown still occured at the same time. "Pegasus (MVP)" wrote: > > "OJG" <OJG@discussions.microsoft.com> wrote in message > news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com... > >I have one server that in the last 2-3 weeks has been rebooting at the > >exact > > same time every day. It shows this in the event log. > > > > Event Type: Information > > Event Source: USER32 > > Event Category: None > > Event ID: 1074 > > Date: 1/16/2008 > > Time: 5:00:47 PM > > User: NT AUTHORITY\SYSTEM > > Computer: ******* > > Description: > > The process winlogon.exe has initiated the restart of computer CORP-ADP on > > behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API > > shutdown > > Reason Code: 0x80070000 > > Shutdown Type: restart > > Comment: > > > > I have checked the AV logs, Landesk tasks and logs and the local task > > scheduler and can not find any indication of what is causing this. I also > > ran > > a full virus and anti spyware scan. Any ideas? > > > > Since this happens at the exact same time each day, the prime > suspect would be some component of a scheduled task. To home > in on the culprit, I would move each task by a multiple of 5 minutes: > Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes. > > I expect that the reboot will now happen x minutes later. If it's > 10 minutes later then Task2 would be the culprit. > > >
Guest Pegasus \(MVP\) Posted January 17, 2008 Posted January 17, 2008 Re: Server reboots every day same time I would now determine if the reboot is caused by an internal or external trigger. I would do it by unplugging its network cable at 4:55 pm and reconnecting it at 5:05 pm, i.e. 5 minutes before & after the shutdown time. Have you considered a virus or malware infection? "OJG" <OJG@discussions.microsoft.com> wrote in message news:E1DE2EDA-4AEE-48BF-B3F2-855DF913D9C9@microsoft.com... > No luck we moved the two scheduled tasks as suggested and the shutdown > still > occured at the same time. > > "Pegasus (MVP)" wrote: > >> >> "OJG" <OJG@discussions.microsoft.com> wrote in message >> news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com... >> >I have one server that in the last 2-3 weeks has been rebooting at the >> >exact >> > same time every day. It shows this in the event log. >> > >> > Event Type: Information >> > Event Source: USER32 >> > Event Category: None >> > Event ID: 1074 >> > Date: 1/16/2008 >> > Time: 5:00:47 PM >> > User: NT AUTHORITY\SYSTEM >> > Computer: ******* >> > Description: >> > The process winlogon.exe has initiated the restart of computer CORP-ADP >> > on >> > behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API >> > shutdown >> > Reason Code: 0x80070000 >> > Shutdown Type: restart >> > Comment: >> > >> > I have checked the AV logs, Landesk tasks and logs and the local task >> > scheduler and can not find any indication of what is causing this. I >> > also >> > ran >> > a full virus and anti spyware scan. Any ideas? >> > >> >> Since this happens at the exact same time each day, the prime >> suspect would be some component of a scheduled task. To home >> in on the culprit, I would move each task by a multiple of 5 minutes: >> Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes. >> >> I expect that the reboot will now happen x minutes later. If it's >> 10 minutes later then Task2 would be the culprit. >> >> >>
Guest deeepak Posted January 18, 2008 Posted January 18, 2008 Re: Server reboots every day same time On Jan 17, 7:48 pm, OJG <O...@discussions.microsoft.com> wrote: > I have one server that in the last 2-3 weeks has been rebooting at the exact > same time every day. It shows this in the event log. > > Event Type: Information > Event Source: USER32 > Event Category: None > Event ID: 1074 > Date: 1/16/2008 > Time: 5:00:47 PM > User: NT AUTHORITY\SYSTEM > Computer: ******* > Description: > The process winlogon.exe has initiated the restart of computer CORP-ADP on > behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API > shutdown > Reason Code: 0x80070000 > Shutdown Type: restart > Comment: > > I have checked the AV logs, Landesk tasks and logs and the local task > scheduler and can not find any indication of what is causing this. I also ran > a full virus and anti spyware scan. Any ideas? Below are few steps that you can try: Boot machine into SAfe mode with Networking Reinstall most recent HP/Compaq server managment Agents/Utilities Disable GFI Mail Essentials and GFI POP2 services We can also set Poolmon on the server and get it analyzed and that would tell us which file or driver is causing the problem. Best option is to set poolmon on the server. If the steps above resolves let me know at deepakchawla00@gmail.com Thanks and Regards Deepak
Guest Brains,None Posted February 1, 2008 Posted February 1, 2008 Re: Server reboots every day same time I heard tell of a janitor who would unplug "an unused computer" to plug in the floor buffer... solution was to lock the computer room... Funny, but something to consider.... ;-) j. Pegasus (MVP) wrote: > I would now determine if the reboot is caused by an internal > or external trigger. I would do it by unplugging its network > cable at 4:55 pm and reconnecting it at 5:05 pm, i.e. 5 minutes > before & after the shutdown time. > > Have you considered a virus or malware infection? > > > "OJG" <OJG@discussions.microsoft.com> wrote in message > news:E1DE2EDA-4AEE-48BF-B3F2-855DF913D9C9@microsoft.com... >> No luck we moved the two scheduled tasks as suggested and the shutdown >> still >> occured at the same time. >> >> "Pegasus (MVP)" wrote: >> >>> "OJG" <OJG@discussions.microsoft.com> wrote in message >>> news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com... >>>> I have one server that in the last 2-3 weeks has been rebooting at the >>>> exact >>>> same time every day. It shows this in the event log. >>>> >>>> Event Type: Information >>>> Event Source: USER32 >>>> Event Category: None >>>> Event ID: 1074 >>>> Date: 1/16/2008 >>>> Time: 5:00:47 PM >>>> User: NT AUTHORITY\SYSTEM >>>> Computer: ******* >>>> Description: >>>> The process winlogon.exe has initiated the restart of computer CORP-ADP >>>> on >>>> behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API >>>> shutdown >>>> Reason Code: 0x80070000 >>>> Shutdown Type: restart >>>> Comment: >>>> >>>> I have checked the AV logs, Landesk tasks and logs and the local task >>>> scheduler and can not find any indication of what is causing this. I >>>> also >>>> ran >>>> a full virus and anti spyware scan. Any ideas? >>>> >>> Since this happens at the exact same time each day, the prime >>> suspect would be some component of a scheduled task. To home >>> in on the culprit, I would move each task by a multiple of 5 minutes: >>> Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes. >>> >>> I expect that the reboot will now happen x minutes later. If it's >>> 10 minutes later then Task2 would be the culprit. >>> >>> >>> > >
Recommended Posts