We have a server on a remote site that's restarted once a week, with the command - shutdown /r /t 100 /c "scheduled reboot" /f /d p:4:1 every time it reboots it logs an event on reboot saying the shutdown was unexpected. The server is connected to a UPS and we don't believe it to be power based, the error occurs every time the scheduled task fires and only then, so it would be unlikely to be power based. The system goes down fine and logs this just before the shutdown - The process C:\Windows\system32\shutdown.exe (SERVER) has initiated the restart of computer SERVER on behalf of user DOMAIN\admin_services for the following reason: Application: Maintenance (Planned) Reason Code: 0x80040001 Shutdown Type: restart Comment: scheduled reboot the next log is from the the service control manager - "The Application Experience service entered the running state." 3 minutes after that logs appear from Kernel-General - "The operating system started at system time 2012-05-03T14:33:44.581196600Z." Then 30 seconds or there abouts later, Eventlog will record eventid 6008 "The previous system shutdown at 10:31:39 PM on 5/3/2012 was unexpected." We can't fathom why it logs the error, but as house keeping we'd like to get rid of it.

Hello, As you said, its a planned reboot. Hope you can see event ID:1074 Source:USER32 in your system log. Do you have any monitoring tool configured to this server ?Regards, Ravikumar P

sorry, I should of said the shutdown text is from eventid 1074, user32. the text is; The process C:\Windows\system32\shutdown.exe (SERVER) has initiated the restart of computer SERVER on behalf of user DOMAIN\admin_services for the following reason: Application: Maintenance (Planned) Reason Code: 0x80040001 Shutdown Type: restart Comment: scheduled reboot we see this, then the eventlog 6008 error. we monitor the server logs, and we'd like to not see the 6008 id in the log if its not the case.

This happens when the Event Log service is not notified about the shutdown event, and as a result, the shutdown operation is incorrectly considered by the Event Log service as an unexpected event. - http://support.microsoft.com/kb/326564 Make sure your server is patched upto date also analyze memory dump file for additional clues. Sachin Gadhave (MCP, MCTS)

Hello Again, Just now I tired with the above command in my test server. Its rebooted well and no such 6008 event ID found in system log. Check the schedule or bat file once. I suspect, while running script server may crashed, check for the dump file & analyse it for root cause. Regards, Ravikumar P

To Find the root cause of the problem you will have to analyze the dump file. http://support.microsoft.com/kb/315263http://www.arabitpro.com

Moreover, when you are doing planned reboot first system log can record in the order of 1074, 6006(The Event log service was stopped),6009,6005(The Event log service was started) & 6013(The system uptime is XX seconds) Note:in between we can see other informational event IDs Regards, Ravikumar P

Hi Sachin there is no dump files, the server shuts down normally, as far as we can tell. we use the same command on more than 20 servers and this is the only one with this problem. We can't find a reason for it, its patched and up to date with everything it runs.

Hi Syed the server doesn't produce any dump files, as it shuts down normally as far as we can tell...

The server in question is scheduled to reboot tonight, in approximately 4 hours. I'll grab the logs in the morning and post the event log between the 1074 and 6013 events.

Heres last night's logs USER32 - 1074 - 10:30:00 The process C:\Windows\system32\shutdown.exe (SERVER) has initiated the restart of computer SERVER on behalf of user DOMAIN\admin_services for the following reason: Application: Maintenance (Planned) Reason Code: 0x80040001 Shutdown Type: restart Comment: scheduled reboot Kernel-General - 12 - 10:33:34 The operating system started at system time 2012-05-07T14:33:32.596796700Z. b06bdrv - 12 - 10:33:35 \Device\NTPNP_PCI0027: Driver initialized successfully. b06bdrv - 12 - 10:33:35 \Device\NTPNP_PCI0028: Driver initialized successfully. b06bdrv - 12 - 10:33:35 \Device\NTPNP_PCI0029: Driver initialized successfully. b06bdrv - 12 - 10:33:35 \Device\NTPNP_PCI0030: Driver initialized successfully. FilterManager - 6 - 10:33;38 File System Filter 'DfsrRo' (6.1, 2010-11-20T17:26:37.000000000Z) has successfully loaded and registered with Filter Manager. Eventlog - 6008 - 10:33:59 The previous system shutdown at 10:31:27 PM on 5/7/2012 was unexpected. Eventlog - 6009 - 10:33:59 Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. Eventlog - 6005 - 10:33:59 The Event log service was started. Eventlog - 6013 - 10:33:59 The system uptime is 27 seconds.

Event ID 6006 is missed in above post.we need to check more on this. Event ID:6006(The Event log service was stopped) Regards, Ravikumar P

Do one more thing schedule the same task in other test system and check the log. If reboot is successful no issue. if we get same kind of error, doubts on batch file or else doubts in schedule task configuration. Regards, Ravikumar P

Hello Melts, Is your problem solved or still getting 6008 event ID in system events? Anyways here is the solution to your post. Disable Automatically restart option and check once. path is My Computer|Properties|Advanced System Settings|Startup and Recovery settings|Automatically restart Still you need more info, please check http://support.microsoft.com/kb/315192Regards, Ravikumar P

Hi Exrapul The error has still been continuing, I've been on a bit of a break but have come back to the same problem. I did try changing the shutdown command to psshutdown.exe and the error still occurred. I'll make the changes as per the KB and let you know if it goes away. Thanks