The process winlogon.exe has initiated the restart of computer
Hi every one.
I have a SharePoint 2007 farm with two servers. One for DB and another for WFE.They are both windows server 2003 32bit and they both are members of our central domain. There is some thing weird with this farm. in the same time
and same day of the week (thursdays) they both will be restarted one after the other and this event apears in their event viewer
Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 1/13/2011
Time: 1:19:31 PM
User: NT AUTHORITY\SYSTEM
Computer: "server name"
Description:
The process winlogon.exe has initiated the restart of computer "server name" on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80020002
Shutdown Type: restart
Comment:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 02 00 02 80 ...?
I'm wondering what the reason could be!
January 13th, 2011 5:16am
Hi,
Check this.
http://social.technet.microsoft.com/Forums/en/winservergen/thread/17dd9be1-6f5d-4952-a940-d232ff3f0029
For SharePoint use this forum
http://social.msdn.microsoft.com/Forums/en/category/sharepoint/
Thanks.
Free Windows Admin Tool Kit Click here and download it now
January 13th, 2011 5:26am
Its possible it is sasser or msblast virus.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
January 13th, 2011 5:29am
Hello M. AMIR,
You can use Shutdown Event Tracker to consistently track the reason for system shutdowns/Restart. You can then use this information to analyze shutdowns/Restart.
Description of the Shutdown Event Tracker
http://support.microsoft.com/kb/293814
BrentPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
January 14th, 2011 1:49am