Server reboots every day same time

[Guest OJG]

I have one server that in the last 2-3 weeks has been rebooting at the exact

same time every day. It shows this in the event log.

 

Event Type: Information

Event Source: USER32

Event Category: None

Event ID: 1074

Date: 1/16/2008

Time: 5:00:47 PM

User: NT AUTHORITY\SYSTEM

Computer: *******

Description:

The process winlogon.exe has initiated the restart of computer CORP-ADP on

behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API

shutdown

Reason Code: 0x80070000

Shutdown Type: restart

Comment:

 

I have checked the AV logs, Landesk tasks and logs and the local task

scheduler and can not find any indication of what is causing this. I also ran

a full virus and anti spyware scan. Any ideas?

[Guest Pegasus \(MVP\)]

Re: Server reboots every day same time

 

 

"OJG" <OJG@discussions.microsoft.com> wrote in message

news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com...

>I have one server that in the last 2-3 weeks has been rebooting at the

>exact

> same time every day. It shows this in the event log.

>

> Event Type: Information

> Event Source: USER32

> Event Category: None

> Event ID: 1074

> Date: 1/16/2008

> Time: 5:00:47 PM

> User: NT AUTHORITY\SYSTEM

> Computer: *******

> Description:

> The process winlogon.exe has initiated the restart of computer CORP-ADP on

> behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API

> shutdown

> Reason Code: 0x80070000

> Shutdown Type: restart

> Comment:

>

> I have checked the AV logs, Landesk tasks and logs and the local task

> scheduler and can not find any indication of what is causing this. I also

> ran

> a full virus and anti spyware scan. Any ideas?

>

 

Since this happens at the exact same time each day, the prime

suspect would be some component of a scheduled task. To home

in on the culprit, I would move each task by a multiple of 5 minutes:

Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes.

 

I expect that the reboot will now happen x minutes later. If it's

10 minutes later then Task2 would be the culprit.

[Guest OJG]

Re: Server reboots every day same time

 

No luck we moved the two scheduled tasks as suggested and the shutdown still

occured at the same time.

 

"Pegasus (MVP)" wrote:

>

> "OJG" <OJG@discussions.microsoft.com> wrote in message

> news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com...

> >I have one server that in the last 2-3 weeks has been rebooting at the

> >exact

> > same time every day. It shows this in the event log.

> >

> > Event Type: Information

> > Event Source: USER32

> > Event Category: None

> > Event ID: 1074

> > Date: 1/16/2008

> > Time: 5:00:47 PM

> > User: NT AUTHORITY\SYSTEM

> > Computer: *******

> > Description:

> > The process winlogon.exe has initiated the restart of computer CORP-ADP on

> > behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API

> > shutdown

> > Reason Code: 0x80070000

> > Shutdown Type: restart

> > Comment:

> >

> > I have checked the AV logs, Landesk tasks and logs and the local task

> > scheduler and can not find any indication of what is causing this. I also

> > ran

> > a full virus and anti spyware scan. Any ideas?

> >

>

> Since this happens at the exact same time each day, the prime

> suspect would be some component of a scheduled task. To home

> in on the culprit, I would move each task by a multiple of 5 minutes:

> Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes.

>

> I expect that the reboot will now happen x minutes later. If it's

> 10 minutes later then Task2 would be the culprit.

>

>

>

[Guest Pegasus \(MVP\)]

Re: Server reboots every day same time

 

I would now determine if the reboot is caused by an internal

or external trigger. I would do it by unplugging its network

cable at 4:55 pm and reconnecting it at 5:05 pm, i.e. 5 minutes

before & after the shutdown time.

 

Have you considered a virus or malware infection?

 

 

"OJG" <OJG@discussions.microsoft.com> wrote in message

news:E1DE2EDA-4AEE-48BF-B3F2-855DF913D9C9@microsoft.com...

> No luck we moved the two scheduled tasks as suggested and the shutdown

> still

> occured at the same time.

>

> "Pegasus (MVP)" wrote:

>

>>

>> "OJG" <OJG@discussions.microsoft.com> wrote in message

>> news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com...

>> >I have one server that in the last 2-3 weeks has been rebooting at the

>> >exact

>> > same time every day. It shows this in the event log.

>> >

>> > Event Type: Information

>> > Event Source: USER32

>> > Event Category: None

>> > Event ID: 1074

>> > Date: 1/16/2008

>> > Time: 5:00:47 PM

>> > User: NT AUTHORITY\SYSTEM

>> > Computer: *******

>> > Description:

>> > The process winlogon.exe has initiated the restart of computer CORP-ADP

>> > on

>> > behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API

>> > shutdown

>> > Reason Code: 0x80070000

>> > Shutdown Type: restart

>> > Comment:

>> >

>> > I have checked the AV logs, Landesk tasks and logs and the local task

>> > scheduler and can not find any indication of what is causing this. I

>> > also

>> > ran

>> > a full virus and anti spyware scan. Any ideas?

>> >

>>

>> Since this happens at the exact same time each day, the prime

>> suspect would be some component of a scheduled task. To home

>> in on the culprit, I would move each task by a multiple of 5 minutes:

>> Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes.

>>

>> I expect that the reboot will now happen x minutes later. If it's

>> 10 minutes later then Task2 would be the culprit.

>>

>>

>>

[Guest deeepak]

Re: Server reboots every day same time

 

On Jan 17, 7:48 pm, OJG <O...@discussions.microsoft.com> wrote:

> I have one server that in the last 2-3 weeks has been rebooting at the exact

> same time every day. It shows this in the event log.

>

> Event Type:     Information

> Event Source:   USER32

> Event Category: None

> Event ID:       1074

> Date:           1/16/2008

> Time:           5:00:47 PM

> User:           NT AUTHORITY\SYSTEM

> Computer:       *******

> Description:

> The process winlogon.exe has initiated the restart of computer CORP-ADP on

> behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API

> shutdown

>  Reason Code: 0x80070000

>  Shutdown Type: restart

>  Comment:

>

> I have checked the AV logs, Landesk tasks and logs and the local task

> scheduler and can not find any indication of what is causing this. I also ran

> a full virus and anti spyware scan. Any ideas?

 

 

Below are few steps that you can try:

 

Boot machine into SAfe mode with Networking

Reinstall most recent HP/Compaq server managment Agents/Utilities

Disable GFI Mail Essentials and GFI POP2 services

 

We can also set Poolmon on the server and get it analyzed and that

would tell us which file or driver is causing the problem.

 

Best option is to set poolmon on the server.

 

If the steps above resolves let me know at deepakchawla00@gmail.com

 

Thanks and Regards

Deepak

[Guest Brains,None]

Re: Server reboots every day same time

 

I heard tell of a janitor who would unplug "an unused computer" to plug

in the floor buffer... solution was to lock the computer room... Funny,

but something to consider....

 

;-)

 

j.

 

Pegasus (MVP) wrote:

> I would now determine if the reboot is caused by an internal

> or external trigger. I would do it by unplugging its network

> cable at 4:55 pm and reconnecting it at 5:05 pm, i.e. 5 minutes

> before & after the shutdown time.

>

> Have you considered a virus or malware infection?

>

>

> "OJG" <OJG@discussions.microsoft.com> wrote in message

> news:E1DE2EDA-4AEE-48BF-B3F2-855DF913D9C9@microsoft.com...

>> No luck we moved the two scheduled tasks as suggested and the shutdown

>> still

>> occured at the same time.

>>

>> "Pegasus (MVP)" wrote:

>>

>>> "OJG" <OJG@discussions.microsoft.com> wrote in message

>>> news:73C3F879-E83B-4FB8-82D2-5BE79CAFDD8B@microsoft.com...

>>>> I have one server that in the last 2-3 weeks has been rebooting at the

>>>> exact

>>>> same time every day. It shows this in the event log.

>>>>

>>>> Event Type: Information

>>>> Event Source: USER32

>>>> Event Category: None

>>>> Event ID: 1074

>>>> Date: 1/16/2008

>>>> Time: 5:00:47 PM

>>>> User: NT AUTHORITY\SYSTEM

>>>> Computer: *******

>>>> Description:

>>>> The process winlogon.exe has initiated the restart of computer CORP-ADP

>>>> on

>>>> behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API

>>>> shutdown

>>>> Reason Code: 0x80070000

>>>> Shutdown Type: restart

>>>> Comment:

>>>>

>>>> I have checked the AV logs, Landesk tasks and logs and the local task

>>>> scheduler and can not find any indication of what is causing this. I

>>>> also

>>>> ran

>>>> a full virus and anti spyware scan. Any ideas?

>>>>

>>> Since this happens at the exact same time each day, the prime

>>> suspect would be some component of a scheduled task. To home

>>> in on the culprit, I would move each task by a multiple of 5 minutes:

>>> Task1: 5 minutes, Task2:10 minutes, Task3:15 minutes.

>>>

>>> I expect that the reboot will now happen x minutes later. If it's

>>> 10 minutes later then Task2 would be the culprit.

>>>

>>>

>>>

>

>