I have been fighting this problem for about a week now, that many others seem to be having on various flavors of Vista/7/2008/2008R2, where Windows seemingly randomly shuts down on its own and logs the 0x500ff Winlogon.exe NT Authority/System message 1074 in the System Event Log. This is happening on an IBM xSeries x3455 m/t 7984-AC1 that initially had the problem on Server 2008 32-bit. I exhausted all possibilities for updates to firmware and drivers that I could find on the IBM support site for the machine and OS version, so I backed up the data and installed Server 2008 R2, only to have the problem crop up again. Behaviors that I have found and theories that I have: If you unplug the cable to the Broadcom Netxtreme Gigabit NIC, the machine will stay up and running for a long time if not indefinitely (in our case the server stayed up over the weekend, where this shutdown would have normally occurred either within a few minutes or within 3-4 hours). This would seem to point to either firmware or drivers for this NIC as to the cause of the problem. I have upgraded the Broadcom NetXtreme driver to the latest 2008x64 version (v14.2.11.1) directly from Broadcom's website. I'm hopeful that this has resolved the issue, but will report back if not.

No dice. The server went down again at some point since my last post. Any ideas what this problem could be? It's basically a clean load of Server 2008 R2 now with all the latest patches, is running Symantec Endpoint Protection (no viruses ever) and Filezilla Server.

Having exactly the same issue on a SBS 2008 - everything is as updated as can be, but still I get this: The process C:\Windows\system32\winlogon.exe (server) has initiated the power off of computer ESOBBACKUP on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found Reason Code: 0x500ff Shutdown Type: power off Comment: I can't find any solution to this anywhere...

Hi, Please visit the following KB: On a computer running Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 an incorrect shutdown reason code written to SEL on user initiated shutdown Best Regards DalePlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Dale, I've seen that article, but it does not explain the fact that the machine is shutting down on its own. No one is pushing the power button. No one is doing a manual or remote shutdown. Something internal is triggering winlogon.exe to shutdown and power off the system and I can't figure out what. Any other ideas? Anything else I should be looking for or checking? Thanks

Is the computer joined the domain? Do you log on with the domain profile or local profile? Please test the local profile and see if the issue occurs. To solid troubleshoot the problem, I would like to suggest you using ADPlus to configure the Crash mode dumps for Winlogon.exe process as per the KB bellow: How to use ADPlus to troubleshoot "hangs" and "crashes" http://support.microsoft.com/kb/286350 Once you install the Debugging tool, please run the below command: C:\program files\Debugging tools for windows>cscript adplus.vbs -crash -pn Winlogon.exe –nodumponfirst Meanwhile, this could be caused by hardware, please contact the computer vendor for technical support as well. Best Regards DalePlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thank you, Dale. This machine is currently a standalone server, so AD is not yet installed, but thanks for the tip on the debugging tool. We actually had a hardware guy checkout the system yesterday and he is replacing the power supply. He said there was something in the BIOS error log regarding DC current. I will get the full story from him on this and post it later. I will keep you posted on the results and if this fixes the issue for us. Thanks again.

The power supply replacement seems to have fixed this issue for us. Thanks for your help, Dale.