The process winlogon.exe has initiated the restart of computer
Hi every one. I have a SharePoint 2007 farm with two servers. One for DB and another for WFE.They are both windows server 2003 32bit and they both are members of our central domain. There is some thing weird with this farm. in the same time and same day of the week (thursdays) they both will be restarted one after the other and this event apears in their event viewer Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 1/13/2011 Time: 1:19:31 PM User: NT AUTHORITY\SYSTEM Computer: "server name" Description: The process winlogon.exe has initiated the restart of computer "server name" on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found Reason Code: 0x80020002 Shutdown Type: restart Comment: For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 02 00 02 80 ...? I'm wondering what the reason could be!
January 13th, 2011 5:16am

Hi, Check this. http://social.technet.microsoft.com/Forums/en/winservergen/thread/17dd9be1-6f5d-4952-a940-d232ff3f0029 For SharePoint use this forum http://social.msdn.microsoft.com/Forums/en/category/sharepoint/ Thanks.
Free Windows Admin Tool Kit Click here and download it now
January 13th, 2011 5:26am

Its possible it is sasser or msblast virus. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
January 13th, 2011 5:29am

Hello M. AMIR, You can use Shutdown Event Tracker to consistently track the reason for system shutdowns/Restart. You can then use this information to analyze shutdowns/Restart. Description of the Shutdown Event Tracker http://support.microsoft.com/kb/293814 BrentPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
January 14th, 2011 1:49am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics