I have a windows 2008 R2 server, which was configured and installed by a 3rd party vendor. EVerytime the server is rebooted, we are prompted to supply the reason for the unexpected shutdown. It's a dell server and Dell openmanage indicates a normal shutdown/restart. In combing through the event logs i find this error message "The Windows Management Instrumentation Service has detected an inconsistent system shutdown. I've googled this and not found a lot of info. I am at a loss as where to begin my troubleshooting. Any direction is appreciated.

Hello, i have seen this sometimes if a machine is shutdown/rebooted via RDC instead on the server console direct. Do you have it both ways?Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hello, i have seen this sometimes if a machine is shutdown/rebooted via RDC instead on the server console direct. Do you have it both ways?Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hi Betty, How did you reboot the server, remotely or locally on the server? Please ensure the Remote Registry service has been started if you shut down the computer remotely. A registry key value tells Shutdown Event Tracker when to prompt a user for information about an unexpected restart or shutdown. Without remote registry access, Shutdown Event Tracker cannot remotely reset this registry key value after you have provided a reason. When Shutdown Event Tracker is enabled, users cannot shut down or restart the computer without providing a reason. If the computer is shut down or restarted unexpectedly, either as a result of power interruption or hardware failure, the first member of the local Users group to log in after the restart is prompted to enter a reason in Shutdown Event Tracker. Alternatively, you can disable Shutdown Event Tracker through local Group Policy settings to avoid the shutdown reason window. To do this, please follow these steps. Click Start, click in the Search box, and type gpedit.msc.The Group Policy Object Editor dialog box appears. In the Local Computer Policy navigation pane, expand Computer Configuration, expand Administrative Templates, and click System. In the console pane, scroll down to the list of objects, right-click Display Shutdown Event Tracker, and click Properties. On the Settings tab, click Disabled. For more information about Shutdown Event Tracker, please refer to the link below. http://technet.microsoft.com/en-us/library/cc770960.aspx Regards, Karen Ji Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ” This posting is provided "AS IS" with no warranties, and confers no rights. On July 1st we will be making this forum read only. After receiving a lot of feedback from the community, it was decided that this forum is a duplication and therefore redundant of the General Forum. So, until July 1st, we will start asking customers to redirect their questions to the General Forum. On June 11th, CSS engineers will move any new threads to the General Forum. Please post a reply to the announcement thread if you have any feedback on this decision or the process. You can also email WSSDComm@microsoft.com.

I receive this error when I am right at the console or when I rdp boot. The remote registry service is enabled and started. Often I am rebooting because of windows security patches, so when prompted to restart - i do. I am not asked to supply the reason. (This is similar to my other 2008 servers but only this one gives me grief). I will check your link about shutdown tracker and see if I can find out more info. thank you for the questions and responses.

I receive this error when I am right at the console or when I rdp boot. The remote registry service is enabled and started. Often I am rebooting because of windows security patches, so when prompted to restart - i do. I am not asked to supply the reason. (This is similar to my other 2008 servers but only this one gives me grief). I will check your link about shutdown tracker and see if I can find out more info. thank you for the questions and responses.

Anyone get this resolved. I am having the same issue with 2008 R2. Mine is a virtual running on esx 4 update 1.

Anyone get this resolved. I am having the same issue with 2008 R2. Mine is a virtual running on esx 4 update 1.

Same here. I'm running 2008 R2 virtualized on 2008 R2 Hyper-V.

Same here. I'm running 2008 R2 virtualized on 2008 R2 Hyper-V.

I still have this problem as well. I've opened a case with Microsoft but so far, we've had no luck in resolving it. They are pointing me back to Dell hardware support.

I still have this problem as well. I've opened a case with Microsoft but so far, we've had no luck in resolving it. They are pointing me back to Dell hardware support.

I have the same issue on a 2008 R2 box without Dell hardware. Any news on this?

I have the same issue on a 2008 R2 box without Dell hardware. Any news on this?

I am also recieving this error on all of my 2008 R2 Data Center boxes running on Dell PowerEdge R710's.Hi

I am also recieving this error on all of my 2008 R2 Data Center boxes running on Dell PowerEdge R710's.Hi

I'm in the same boat. For me it is occurring on my vCenter 4.1 server which is a virtual server (W2K8 R2). I performed a domain migration, pretty straight forward right? Well, the domain migration went just fine, however, every time I reboot the server either via the console using VI client OR RDP, I get the shutdown tracker upon reboot looking for an answer as to why the server was shutdown "unexpectedly". The other thing I notice that is strange is that after all of the services have loaded, the server does some kind of time synchronization that changes the local time of the server to be incorrect (about 30 mins slow). The mysterious part is that when the server boots and I first login to Windows the time is correctly synchronized with the AD domain controllers. I don't know what to make of this. It's almost like there is some service that is restoring the system to a previous state when maybe the server wasn't shutdown properly. Any ideas on this would be greatly appreciated. Thanks, --Kevin

I'm in the same boat. For me it is occurring on my vCenter 4.1 server which is a virtual server (W2K8 R2). I performed a domain migration, pretty straight forward right? Well, the domain migration went just fine, however, every time I reboot the server either via the console using VI client OR RDP, I get the shutdown tracker upon reboot looking for an answer as to why the server was shutdown "unexpectedly". The other thing I notice that is strange is that after all of the services have loaded, the server does some kind of time synchronization that changes the local time of the server to be incorrect (about 30 mins slow). The mysterious part is that when the server boots and I first login to Windows the time is correctly synchronized with the AD domain controllers. I don't know what to make of this. It's almost like there is some service that is restoring the system to a previous state when maybe the server wasn't shutdown properly. Any ideas on this would be greatly appreciated. Thanks, --Kevin

I'm having the same problem with the tracker once I login to any of my 2008 R2 servers, and it happens across physical and virtual systems, even when I manually shutdown and supply a reason. @Kevin So far as your time sync issue, double check that VMware Tools isn't set to synchronize the servers time with the vSphere Host. Regards, MatthewRegards, Matthew

I have the same issue on a 2008 R2 box with Intel Server hardware. Any news on this? Thanks

I'm having the same problem with the tracker once I login to any of my 2008 R2 servers, and it happens across physical and virtual systems, even when I manually shutdown and supply a reason. @Kevin So far as your time sync issue, double check that VMware Tools isn't set to synchronize the servers time with the vSphere Host. Regards, MatthewRegards, Matthew

I have the same issue on a 2008 R2 box with Intel Server hardware. Any news on this? Thanks

For me, the problem was Blackberry Enterprise Server Express running on the system. I've installed BES on a few Windows 2008 R2 systems and they all have this shutdown issue. I opened an MS support case and was told that BES does not properly clean up files on shutdown.

For me, the problem was Blackberry Enterprise Server Express running on the system. I've installed BES on a few Windows 2008 R2 systems and they all have this shutdown issue. I opened an MS support case and was told that BES does not properly clean up files on shutdown.

I've been building a Blackberry Enterprise Server Express system inside VMWare Workstation and after I installed BES it started doing this. BES sucks. This just confirms it. Please let me know if anybody figures out how to fix it.

I opened a support case with Blackberry on this a couple of months ago, but I don't think they're too concerned about fixing it (or even acknowledging it). I don't think the support person had to worry about the annoyance of shutting down a server then checking it every time you reboot it to make sure there is not a genuine problem with the system. Here is the fundamental reason for the problem as described to me by Microsoft: Windows Server 2008 onward we maintain a heartbeat file to determine whether we have a clean shutdown or not. Files are LastAlive0 or LastAlive1 in C:\windows\ServiceProfiles\LocalService\AppData\Local. If the LASTALIVESTAMP is present and if we can successfully read heartbeat data, it indicates that the previous shutdown was abnormal, i.e. we didn't execute our normal shutdown cleanup code. For some reason lastalive0.dat and lastalive1.dat at C:\windows\ServiceProfiles\LocalService\AppData\Local were not getting deleted while doing a clean shut down/Reboot. Many cases show that Blackberry Service can cause the problem. Because Blackberry Services putting a handle lastalive file and not releasing it during shutdown process. According to the System Information, I found that Blackberry Service is running. Please check the following path and see if there are files called LastAlive0 or LastAlive1: C:\windows\ServiceProfiles\LocalService\AppData\Local folder. If so, please stop or disable the Blackberry Services before next time you start the server, or you can contact the company of Blackberry and see if there is an update of the service to fix this problem.

I've been building a Blackberry Enterprise Server Express system inside VMWare Workstation and after I installed BES it started doing this. BES sucks. This just confirms it. Please let me know if anybody figures out how to fix it.

I opened a support case with Blackberry on this a couple of months ago, but I don't think they're too concerned about fixing it (or even acknowledging it). I don't think the support person had to worry about the annoyance of shutting down a server then checking it every time you reboot it to make sure there is not a genuine problem with the system. Here is the fundamental reason for the problem as described to me by Microsoft: Windows Server 2008 onward we maintain a heartbeat file to determine whether we have a clean shutdown or not. Files are LastAlive0 or LastAlive1 in C:\windows\ServiceProfiles\LocalService\AppData\Local. If the LASTALIVESTAMP is present and if we can successfully read heartbeat data, it indicates that the previous shutdown was abnormal, i.e. we didn't execute our normal shutdown cleanup code. For some reason lastalive0.dat and lastalive1.dat at C:\windows\ServiceProfiles\LocalService\AppData\Local were not getting deleted while doing a clean shut down/Reboot. Many cases show that Blackberry Service can cause the problem. Because Blackberry Services putting a handle lastalive file and not releasing it during shutdown process. According to the System Information, I found that Blackberry Service is running. Please check the following path and see if there are files called LastAlive0 or LastAlive1: C:\windows\ServiceProfiles\LocalService\AppData\Local folder. If so, please stop or disable the Blackberry Services before next time you start the server, or you can contact the company of Blackberry and see if there is an update of the service to fix this problem.

I am having the same issue as the OP. At first I thought it was the pcAnywhere connection. I recommend uninstalling or stop using any type of remote connection. I believe this is the cause of the problems. We are running Windows Server 2008 Standard 32 bit. We had it in a virtualized environment (virtualbox), but removed it since we thought VirtualBox was the culprit. We have moved onto a physical environment and continue to receive these issues. The new server is on new hardware as well. When I restarted the server due to a Windows update, I did it via pcAnywhere, which then prompted the random restarts of the server. Try restarting the servers physically instead of remotely. Microsoft help us out. Solve this issue, we need remote access to our servers.

I am having the same issue as the OP. At first I thought it was the pcAnywhere connection. I recommend uninstalling or stop using any type of remote connection. I believe this is the cause of the problems. We are running Windows Server 2008 Standard 32 bit. We had it in a virtualized environment (virtualbox), but removed it since we thought VirtualBox was the culprit. We have moved onto a physical environment and continue to receive these issues. The new server is on new hardware as well. When I restarted the server due to a Windows update, I did it via pcAnywhere, which then prompted the random restarts of the server. Try restarting the servers physically instead of remotely. Microsoft help us out. Solve this issue, we need remote access to our servers.

I have noticed this after installing the VMware Tools for ESX 4.1 on my VM'd 2K8 R2 Server.

I have noticed this after installing the VMware Tools for ESX 4.1 on my VM'd 2K8 R2 Server.

I am also having this issue. At first I was concerned as this is running on an email server and the last thing you want is a dirty shutdown potentially causing further problems down the line. I also think suggesting the Shutdown Event Tracker (SET) should be disabled is NOT a workaround to the issue. The OP clearly posted what the issue was and suggesting it should be disabled is poor advice. The only time this should ever be suggested is when the initial SET is appearing before a reboot. This problem is whereby you fill in the first SET and then you are presented with another after reboot. There is obviously a reason for it and until it is resolved, how do you know something more serious isn't going to occur as a result of ignoring it? However, since looking into this issue, in my case I am using RDP and BESE on the email server and I thought I would add my findings. In an attempt to work out what is causing it, I manually stopped all the BlackBerry services from top to bottom in the list and then rebooted. I completed the first SET and after it did reboot and I logged on, I got no SET. So in my case, and possibly those who are also running BESE, this sounds like an issue I've found elsewhere whereby the BB software is not cleanly stopping itself and leaving Windows to deduce an improper shutdown occurred. However, it sounds like RIM have no fix and might not have even acknowledged this as an issue as yet.

I am also having this issue. At first I was concerned as this is running on an email server and the last thing you want is a dirty shutdown potentially causing further problems down the line. I also think suggesting the Shutdown Event Tracker (SET) should be disabled is NOT a workaround to the issue. The OP clearly posted what the issue was and suggesting it should be disabled is poor advice. The only time this should ever be suggested is when the initial SET is appearing before a reboot. This problem is whereby you fill in the first SET and then you are presented with another after reboot. There is obviously a reason for it and until it is resolved, how do you know something more serious isn't going to occur as a result of ignoring it? However, since looking into this issue, in my case I am using RDP and BESE on the email server and I thought I would add my findings. In an attempt to work out what is causing it, I manually stopped all the BlackBerry services from top to bottom in the list and then rebooted. I completed the first SET and after it did reboot and I logged on, I got no SET. So in my case, and possibly those who are also running BESE, this sounds like an issue I've found elsewhere whereby the BB software is not cleanly stopping itself and leaving Windows to deduce an improper shutdown occurred. However, it sounds like RIM have no fix and might not have even acknowledged this as an issue as yet.

I am having the same issue on one of our servers - which is usually just restarted due to windows update. All other servers - same procedure - do not exhibit this behaviour...

I am having the same issue on one of our servers - which is usually just restarted due to windows update. All other servers - same procedure - do not exhibit this behaviour...

Same issue as outlined by all others above. Server generates a 6008 whether rebooted via RDP or console session, with blackberry services stopped, server reboots cleanly. Observed on SBS 2011 Std: All MS patches applied Exchange server 2010 v. 14.01.0218.013 Blackberry Enterprise Server Express 5.0.2.29 Any solutions found that do not require disabling a feature intended to notify admins when there really is a problem?

Same issue as outlined by all others above. Server generates a 6008 whether rebooted via RDP or console session, with blackberry services stopped, server reboots cleanly. Observed on SBS 2011 Std: All MS patches applied Exchange server 2010 v. 14.01.0218.013 Blackberry Enterprise Server Express 5.0.2.29 Any solutions found that do not require disabling a feature intended to notify admins when there really is a problem?

I have this problem as well and I agree that disabling the notification is just about the worst "Answer" I've read coming from a Microsoft employee. Similar to what was already mentioned by a previous poster, this started for me on a single server immediately following a domain migration. The server used to be a domain controller in the previous domain but now is just a member server in the new domain. I have other servers that went through the same process, DC in old domain -> member server in new domain, and they don't have this issue. OS: 2008 Standard SP2 32 bit Hardware: Dell PowerEdge T410 Roles/Software: File and Print server

I have this problem as well and I agree that disabling the notification is just about the worst "Answer" I've read coming from a Microsoft employee. Similar to what was already mentioned by a previous poster, this started for me on a single server immediately following a domain migration. The server used to be a domain controller in the previous domain but now is just a member server in the new domain. I have other servers that went through the same process, DC in old domain -> member server in new domain, and they don't have this issue. OS: 2008 Standard SP2 32 bit Hardware: Dell PowerEdge T410 Roles/Software: File and Print server

Are you running BES on this system as well? Even though I can be critical of Microsoft, this is not their problem if you are. It is RIM's.

Are you running BES on this system as well? Even though I can be critical of Microsoft, this is not their problem if you are. It is RIM's.

Are you running BES on this system as well? Even though I can be critical of Microsoft, this is not their problem if you are. It is RIM's. I've got the issue on a server (it's a 2008 R2 DC, now with SP1, the issue existed before and after the SP1 update) which has never had Blackberry services installed onto it. The issue occurs whether the reboot is remote (through RDP) or local (VMware ESX console - the machine is a VM on a vSphere 4.1 cluster). Regardless of whether RIM software is involved or not, the incorrect behaviour is with a core Microsoft function, and so it IS Microsoft's problem, and NOT RIM's.MCP (Windows 2003, Windows XP)

Are you running BES on this system as well? Even though I can be critical of Microsoft, this is not their problem if you are. It is RIM's. I've got the issue on a server (it's a 2008 R2 DC, now with SP1, the issue existed before and after the SP1 update) which has never had Blackberry services installed onto it. The issue occurs whether the reboot is remote (through RDP) or local (VMware ESX console - the machine is a VM on a vSphere 4.1 cluster). Regardless of whether RIM software is involved or not, the incorrect behaviour is with a core Microsoft function, and so it IS Microsoft's problem, and NOT RIM's.MCP (Windows 2003, Windows XP)

As an system application developer, I can tell you it IS RIM's fault. Services have to respond to system shutdown messages and properly release resources and clean up files. They are not doing that. It is your responsibility as a service developer to handle these situations. The problem is not in the core Microsoft function, but in the incorrect use of it by an application. Your problem is obviously different than the BES problem which many in this thread have experienced.

As an system application developer, I can tell you it IS RIM's fault. Services have to respond to system shutdown messages and properly release resources and clean up files. They are not doing that. It is your responsibility as a service developer to handle these situations. The problem is not in the core Microsoft function, but in the incorrect use of it by an application. Your problem is obviously different than the BES problem which many in this thread have experienced.

I have the exact same thing but experience this on our Terminal Servers which are all installed with Windows 2008 R2 Standard and recently have been upgraded with Service Pack 1. The problem existed before installing Service Pack 1 and now also after Service Pack 1 is installed it is still there. We ofcourse cannot have that the first user who logs on receives the shutdown message especially after we have performed maintenance or installed updates otherwise these servers should not restart. We do use RES PowerFuse on this system but even without that installed I still experience the problem. We deploy our servers using SCCM 2007 SP2 R3 and the image itself is hosted on VMWare, the image itself does not experience this problem but all rolled out servers do. If I use the same installation media used to create the image and manually install a server I can reboot it as much as I want and the problem does not appear. So far I think we can all conclude many people experience this problem but we all have different configurations and different installation methods. I seriously think it is something inside Windows that somehow is triggered but why or how... It still appears even if I manually restart the server and enter a valid message in the shutdown tracker, rebooting it through shutdown.exe command line also has the same effect.

I have the exact same thing but experience this on our Terminal Servers which are all installed with Windows 2008 R2 Standard and recently have been upgraded with Service Pack 1. The problem existed before installing Service Pack 1 and now also after Service Pack 1 is installed it is still there. We ofcourse cannot have that the first user who logs on receives the shutdown message especially after we have performed maintenance or installed updates otherwise these servers should not restart. We do use RES PowerFuse on this system but even without that installed I still experience the problem. We deploy our servers using SCCM 2007 SP2 R3 and the image itself is hosted on VMWare, the image itself does not experience this problem but all rolled out servers do. If I use the same installation media used to create the image and manually install a server I can reboot it as much as I want and the problem does not appear. So far I think we can all conclude many people experience this problem but we all have different configurations and different installation methods. I seriously think it is something inside Windows that somehow is triggered but why or how... It still appears even if I manually restart the server and enter a valid message in the shutdown tracker, rebooting it through shutdown.exe command line also has the same effect.

As an system application developer, I can tell you it IS RIM's fault. Services have to respond to system shutdown messages and properly release resources and clean up files. They are not doing that. It is your responsibility as a service developer to handle these situations. The problem is not in the core Microsoft function, but in the incorrect use of it by an application. Your problem is obviously different than the BES problem which many in this thread have experienced. Correct and the Easy fix is as Follows. If you are Running BES on Server 2k8 R2 Open Group Policy Editor on the Local BES server Expand to Shutdown Scripts gpedit.msc Computer Config Windows Settings Scripts Shutdown Create a new Script Script Name net Script Parameters stop "BlackBerry Controller" Effectively now when you shutdown your server it shuts down the offending Service first. There might be neat scripts but i find this quick and easy. No need to write a script frist and loose it on your disk somewhere.

As an system application developer, I can tell you it IS RIM's fault. Services have to respond to system shutdown messages and properly release resources and clean up files. They are not doing that. It is your responsibility as a service developer to handle these situations. The problem is not in the core Microsoft function, but in the incorrect use of it by an application. Your problem is obviously different than the BES problem which many in this thread have experienced. Correct and the Easy fix is as Follows. If you are Running BES on Server 2k8 R2 Open Group Policy Editor on the Local BES server Expand to Shutdown Scripts gpedit.msc Computer Config Windows Settings Scripts Shutdown Create a new Script Script Name net Script Parameters stop "BlackBerry Controller" Effectively now when you shutdown your server it shuts down the offending Service first. There might be neat scripts but i find this quick and easy. No need to write a script frist and loose it on your disk somewhere.

JakesRNC: Thanks. Should have thought about that myself.

I'm having the same problem with the tracker once I login to any of my 2008 R2 servers, and it happens across physical and virtual systems, even when I manually shutdown and supply a reason. @Kevin So far as your time sync issue, double check that VMware Tools isn't set to synchronize the servers time with the vSphere Host. Regards, Matthew Regards, Matthew im having the same problem as above. the server is 2008 r2 sp1 standard, and it was not happening before. This is the same type of server across a number of locations (independent server), which i replicate, and on all the rest of the replicates work ok to my knowledge... The last 2-3 (from what i can see perhaps since eitehr sp1 or some ms update), i have the same problem. i initiate through the server console directly, eitehr reboot or shutdown, and it just shuts down too quickly. It doesnt even shut down the Hyperv machines running in it, so they also crash... this is a problem with me, as i have oracle db in the hyperv machine, which crashes and causes long time to recover the dbs... i tried remote, or local shutdown, its the same effect. The thing is it doesnt always do it, but it might do it continously for 3-4 restarts, and then stop again... i can see in the even viewer that user .... has initiated a shutdown, then 2-3 lines, and then i cannot see any services shutting down in the system log!!! then it just shutsdown, an di get (as it should) a previous shutdown was not expected error. SO IT DOESNT MAKE SENSE!!! i dont have bberry, or other services. I have Hyper v wih 1 server 2003r2 server, and terminal services on the 2008r2 server. I do have acronis, but i dont think htat would be the reason as i have more or less the same configuration on the other locations... im afraid aboiut the hyperv machines... any ideas would be welcome... brgds Angel

I'm having the same problem with the tracker once I login to any of my 2008 R2 servers, and it happens across physical and virtual systems, even when I manually shutdown and supply a reason. @Kevin So far as your time sync issue, double check that VMware Tools isn't set to synchronize the servers time with the vSphere Host. Regards, Matthew Regards, Matthew im having the same problem as above. the server is 2008 r2 sp1 standard, and it was not happening before. This is the same type of server across a number of locations (independent server), which i replicate, and on all the rest of the replicates work ok to my knowledge... The last 2-3 (from what i can see perhaps since eitehr sp1 or some ms update), i have the same problem. i initiate through the server console directly, eitehr reboot or shutdown, and it just shuts down too quickly. It doesnt even shut down the Hyperv machines running in it, so they also crash... this is a problem with me, as i have oracle db in the hyperv machine, which crashes and causes long time to recover the dbs... i tried remote, or local shutdown, its the same effect. The thing is it doesnt always do it, but it might do it continously for 3-4 restarts, and then stop again... i can see in the even viewer that user .... has initiated a shutdown, then 2-3 lines, and then i cannot see any services shutting down in the system log!!! then it just shutsdown, an di get (as it should) a previous shutdown was not expected error. SO IT DOESNT MAKE SENSE!!! i dont have bberry, or other services. I have Hyper v wih 1 server 2003r2 server, and terminal services on the 2008r2 server. I do have acronis, but i dont think htat would be the reason as i have more or less the same configuration on the other locations... im afraid aboiut the hyperv machines... any ideas would be welcome... brgds Angel

I have a Hyper-V of Windows Server 2008 R2 and have the same issue of the event tracker appearing after every restart. Event tracker shows up even after restarting from a Windows update.

I have a Hyper-V of Windows Server 2008 R2 and have the same issue of the event tracker appearing after every restart. Event tracker shows up even after restarting from a Windows update.

Hi Threonine, I spent several hours today trying to discover what was causing this. I still have a little more work to do but it looks to be the KACE Agent. Let me know what you find if you shut off the service using msconfig or uninstall it. UPDATE: There is a confirmed bug with the KACE Agent and Windows 2008 R2. They are planning to have it resolved with a new release. Dorena

Just started experiencing this problem on a Win2008 R2 SP1 domain controller on VMware ESXi 4.1 at one customer site. Noticed it after installing the latest Windows Updates. Server is running AD, DHCP, DNS, Dell KACE Agent 5.3.47657, Liebert MultiLink 4.0.004, Sophos Endpoint Security 9.5.5. Same results from both RDP and console... Just tried stopping and disabling all Sophos services and rebooting again and that did not make any difference. Note: I also just found and fixed a major issue with W32Time on this server. Not sure if that was somehow related to this issue, but since fixing the W32Time problem, the Shutdown Event Tracker issue still exists. Ok, found the problem now... The Dell KACE Agent 5.3.47657 appears to be the issue. After disabling it and stopping the service, the problem is resolved.

I am experiencing this same issue on two freshly installed Win 2008 R2 servers running as VMs under vSphere 4.1. I do not have any Blackberry services installed. The only thing I've done on both are to run the security wizard, install sophos antivirus, update the vmware tools, install KBOX client. Will have to see if any of those cause the issue. If anyone else notices this and has a similar setup please let me know what you've discovered.

Hi Threonine, I spent several hours today trying to discover what was causing this. I still have a little more work to do but it looks to be the KACE Agent. Let me know what you find if you shut off the service using msconfig or uninstall it. Dorena

I assume you meant net stop "BlackBerry Controller"

I assume you meant net stop "BlackBerry Controller"

Yes. If you use a shutdown scirpt enter: Script Name: net Script Parameters: stop "BlackBerry Controller"

Yes. If you use a shutdown scirpt enter: Script Name: net Script Parameters: stop "BlackBerry Controller"

Oh OK. I didn't realize the "name" was the executable it was running. Thanks.

Oh OK. I didn't realize the "name" was the executable it was running. Thanks.

I'm having the same problems... ESXi with 2008 R2. Everytime we restart via RDP it says there was an unexpected shutdown. Disabling that message isn't an answer. It seemed like it popped up after we put some windows updates last fall. Any ideas??? We don't have KACE or BES installed on it.

I see no answer to this error? I have an imaged server with a base 2008R2 SP1 on it. No matter if I shutdown locally or remotely I get the question on every reboot. The server doesnt exhibit any other problem and we have been using this image for quite a while. It has nothing installed on the OS. Has anyone come up with an answer that I missed?

Hello Dorena, I also run a KACE and after reading your post I decided to create a shutdown script via GPO: Script Name: net Script Parameters: stop "Dell KACE Agent" And it works perfectly! -Robert

I just confirmed this with another server. I installed windows updates and it started show up on a new server. It happened after one of these updates. If I get a chance I may try and uninstall some of them and see which one it is.

I actually just uninstalled KB977238 and it fixed it. I'm trying it on another server.

Didn't fix it on another server....

This just starting happening on a Server 2008 R2 Hyper-V guest running on the same OS host. It has been perfect for 12 months prior to last night, when I installed updates KB2729094 and KB2647753. It happened on the restart prompted by the updates, then on a second restart to test if it repeated itself. The error appears to be erroneous so I'm reluctant to roll back updates on an otherwise functional production server, especially when it seems unlikely they would be the cause of the problem. The server is running SQL Server 2008, Teamviewer and Shadowprotect. No AV software or BB software is present. It is a HP ML350 G6 fully updated and patched, it has other Server 2008 R2 guests that don't present the error.