Tech Support Forum banner
Cancel
Create thread New Forums
Status
Not open for further replies.

[SOLVED] Server Randomly Shuts Down

Jump to Latest
74K views 7 replies 2 participants last post by  Wand3r3r  
N
#1 ·
This started happening about 3 days ago. The server will be running fine, and then it will gracefully shut down for anywhere from 2-5 hours and then it will come back up and will be fine for the rest of the day. The timing appears to be random and the time length is random as well. Even log shows that there are a few processes that initiate this, but there's no comment.

The process C:\Windows\system32\winlogon.exe (SERVERNAME) has initiated the power off of computer SERVERNAME on behalf of DOMAIN\nickh for the following reason: no title for this reason could be found
Reason code: 0x500ff
Shutdown Type: power off
Comment:

Yesterday, it was down for 2 hours and 15 minutes, before it was 6 hours, and before that it was 3 hours. One for sure was called by svhost which I think is automatic updates. It only seems to happen between 8am and noon, but there are no scheduled tasks and nothing unusual running in msconfig or registry. There is also nothing in the startup program. The system isn't overheating according to SpeedFan. Some forums suggested a faulty power supply. I've tested that as well and found no issues with a PSU tester. The server is plugged into a UPS, and it hasn't generated any events that I'm aware of. Spiceworks shows that the last power event for it was almost 3 months ago. I'm at a standstill and can't find anything useful to help troubleshoot this. Any ideas? Logs available upon request.

Note: The SERVERNAME and DOMAIN have been masked for security purposes.

System is running Windows Server 2008 R2 SP1
Asus M4n68T-V2 motherboard w/ 8GB RAM
AMD Athlon II 3-core processor
WD 7200rpm 1TB SATA hard drive
2 NIC cards

Let me know if you need anymore details.
 
N
#3 ·
Re: Server Randomly Shuts Down

The nickh account is the primary domain administrator. During the times the shutdown is occurring, nobody is logged on. It also appears that it is calling from winlogon.exe. The only thing I can think of is that the UPS may not be passing power correctly and windows shuts down to prevent data loss?
 
W
#4 ·
Re: Server Randomly Shuts Down

The error is specific. By disabling the account whatever process is shutting the system down will fail to shut it down and will generate a error in the event viewer log.

If no one is logged on than odds are you assigned this user to a service [improper procedure] and its that service shutting down the system.

If it was the ups it would have to initiate a shutdown script and would do so not due to "passing power" but it detected a power loss which results in the shutdown script activating.
 
N
#5 ·
Re: Server Randomly Shuts Down

Update: I ran a test yesterday by having that user logged in 24hrs via RDP and monitored logs. It didn't shutdown at anytime yesterday. I also verified the services and they are all set to logon as either Local System or Network Service. Also, while reviewing the logs more, I found the same error that was called by NT AUTHORITY\System for a shutdown with error 0x500ff. I also found 3 events in the time of the shutdowns from the Kernel-Power-Manager.

The kernel power manager has initiated a shutdown transition.
Event 109 Kernel-Power

Since it didn't shutdown yesterday, and is so far so good today with constant logon, I really can't pinpoint the problem for sure. I'm sure it is related to the user account, but if possible, I'd like to resolve it without disabling the account.
 
W
#6 ·
Re: Server Randomly Shuts Down

You do have other domain admin accounts don't you? You should always have admin back doors into the system.

error 0x500ff means system failure according to Microsoft but MS provides no hints on the cause.

I would be preparing for catastrophic system failure. Make sure you have tested as good backups.
 
N
#7 ·
Re: Server Randomly Shuts Down

So far so good, the system hasn't shutdown in a few days, but I did make sure that the server image is current and has tested properly in case of a failure. Also, I do have one other domain admin account that can be used in case of emergency or lockout that has equivalent permissions to this current account.

Strangely, this problem hasn't reoccurred in a few days. Not sure if that's good or ominous, but the image is current and the backup is being taken and tested daily just to be safe.
 
Status
Not open for further replies.
You have insufficient privileges to reply here.
Tech Support Forum
posts
4.8M
members
966K
Since
2002
A forum community dedicated to tech experts and enthusiasts. Come join the discussion about articles, computer security, Mac, Microsoft, Linux, hardware, networking, gaming, reviews, accessories, and more!
Full Forum Listing
Explore Our Forums
Windows XP Support Windows 7 , Windows Vista Support Motherboards, Bios|UEFI & CPU Networking Support Laptop Support