Hi All, I have a Windows Server 2008 R2 VM that logs event 6008 after every clean shutdown / restart and displays a window to record the reason of the unexpected shutdown. Has anyone else come across this and knows how to resolve it? ThanksDavid Hodgson Add me on Twitter and LinkedIn www.infinitygroup.co.uk

Is the user a member of local administrators group? Have default permissions been altered? What happens if you do shutdown without restart? Also try from command line via shutdown.exe Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]

Hi David, According to your description, I have studied this issue and found an article to troubleshooting: Shutdown Event Tracker Tools and Settings http://technet.microsoft.com/en-us/library/cc778526(WS.10).aspx Deleted the Following Key LastAliveStamp Registry path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability Version: Windows Server 2003. This key is cleared during shutdown. It indicates the date and time of the previous unexpected shutdown if it is present during startup. But this key is regenerated after every reboot. Behavior changed in Windows 2008 The mechanism has changed from 2003 REGSTR_VAL_LASTALIVESTAMP (LastAliveStamp-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability) is used to store the magic number which is written every time when the system boots so that we don’t log event 6008 in an event of Restore OR resume hibernation. Also the magic number is cleared every time the system shuts down cleanly. DIRTY_SHUTDOWN_MAGIC_VALUE (0x0badbad0) Windows Server 2008 onward we maintain a heartbeat file to determine whether we have a clean shutdown or not. Files are LastAlive0 or LastAlive1 in C:\windows\ServiceProfiles\LocalService\AppData\Local They are Populated using the following parameters (including Power management events like hibernation ) current UTC time system uptime (secs) heartbeat forced (disk idle) maximum heartbeat interval current interval policy current disk pm policy current UTC time of boot if the LASTALIVESTAMP is present and If we can successfully read heartbeat data it indicates that the previous shutdown was abnormal, i.e. we didn't execute our normal shutdown cleanup code. Resolution ------------------- For some reason lastalive0.dat and lastalive1.dat at C:\windows\ServiceProfiles\LocalService\AppData\Local were not getting deleted while doing a clean shut down/Reboot. First of all, you must backup these files, then you can try to Remove the lastalive0.dat and lastalive1.dat from the Server , it can be done by deleting the handles to the file using Procexp or by booting to WINPE or WINRE etc. Then you can test to see whether the issue still exists.Technology changes life

Hi, Whether your problem has been solved. Looking forward to your feedback.Technology changes life

Hi Dollar Wang I have a similar problem on Windows 2008 R2 I followed your advice, and managed to rename/delete the two lastalive0.dat and lastalive1.dat files. I immediately restarted, and I did not get the unexpected shutdown error in System Log. I thought that this problem is now solved But, as a further test, I then restarted the server again. This time I'm getting the unexpected shutdown error. Looking at the timestamp of the 2 dat files, it looks like Windows is not updating the files at all since the previous reboot. Any ideas? Nick