I have a windows 2008 R2 server, which was configured and installed by a 3rd party vendor.  EVerytime the server is rebooted, we are prompted to supply the reason for the unexpected shutdown.  It's a dell server and Dell openmanage indicates a normal shutdown/restart. In combing through the event logs i find this error message "The Windows Management Instrumentation Service has detected an inconsistent system shutdown.

I've googled this and not found a lot of info.  I am at a loss as where to begin my troubleshooting.  Any direction is appreciated.

• Moved by Karen Ji Monday, June 28, 2010 5:34 AM (From:Windows Server 2008 R2 General)

Hello,

i have seen this sometimes if a machine is shutdown/rebooted via RDC instead on the server console direct. Do you have it both ways?

Hi Betty,

How did you reboot the server, remotely or locally on the server?

Please ensure the Remote Registry service has been started if you shut down the computer remotely. A registry key value tells Shutdown Event Tracker when to prompt a user for information about an unexpected restart or shutdown. Without remote registry access, Shutdown Event Tracker cannot remotely reset this registry key value after you have provided a reason.

When Shutdown Event Tracker is enabled, users cannot shut down or restart the computer without providing a reason. If the computer is shut down or restarted unexpectedly, either as a result of power interruption or hardware failure, the first member of the local Users group to log in after the restart is prompted to enter a reason in Shutdown Event Tracker.

Alternatively, you can disable Shutdown Event Tracker through local Group Policy settings to avoid the shutdown reason window. To do this, please follow these steps.

1. Click Start, click in the Search box, and type gpedit.msc.The Group Policy Object Editor dialog box appears.
2. In the Local Computer Policy navigation pane, expand Computer Configuration, expand Administrative Templates, and click System.
3. In the console pane, scroll down to the list of objects, right-click Display Shutdown Event Tracker, and click Properties.
4. On the Settings tab, click Disabled.

For more information about Shutdown Event Tracker, please refer to the link below.

http://technet.microsoft.com/en-us/library/cc770960.aspx

Regards,

Karen Ji

I receive this error when I am right at the console or when I rdp  boot.  The remote registry service is enabled and started.  Often I am rebooting because of windows security patches, so when prompted to restart - i do.  I am not asked to supply the reason.  (This is similar to my other 2008 servers but only this one gives me grief).

I will check your link about shutdown tracker and see if I can find out more info.  thank you for the questions and responses.

I'm in the same boat.  For me it is occurring on my vCenter 4.1 server which is a virtual server (W2K8 R2).  I performed a domain migration, pretty straight forward right?  Well, the domain migration went just fine, however, every time I reboot the server either via the console using VI client OR RDP, I get the shutdown tracker upon reboot looking for an answer as to why the server was shutdown "unexpectedly".  The other thing I notice that is strange is that after all of the services have loaded, the server does some kind of time synchronization that changes the local time of the server to be incorrect (about 30 mins slow).  The mysterious part is that when the server boots and I first login to Windows the time is correctly synchronized with the AD domain controllers.  I don't know what to make of this.  It's almost like there is some service that is restoring the system to a previous state when maybe the server wasn't shutdown properly.

Any ideas on this would be greatly appreciated.

Thanks,

--Kevin

I'm having the same problem with the tracker once I login to any of my 2008 R2 servers, and it happens across physical and virtual systems, even when I manually shutdown and supply a reason.

@Kevin

So far as your time sync issue, double check that VMware Tools isn't set to synchronize the servers time with the vSphere Host.

Regards,

Matthew

I have the same issue on a 2008 R2 box with Intel Server hardware.  Any news on this?

Thanks

I've been building a Blackberry Enterprise Server Express system inside VMWare Workstation and after I installed BES it started doing this.  BES sucks.  This just confirms it.  Please let me know if anybody figures out how to fix it.

I opened a support case with Blackberry on this a couple of months ago, but I don't think they're too concerned about fixing it (or even acknowledging it).  I don't think the support person had to worry about the annoyance of shutting down a server then checking it every time you reboot it to make sure there is not a genuine problem with the system.

Here is the fundamental reason for the problem as described to me by Microsoft:

Windows Server 2008 onward we maintain a heartbeat file to determine whether we have a clean shutdown or not. Files are LastAlive0 or LastAlive1 in C:\windows\ServiceProfiles\LocalService\AppData\Local. If the LASTALIVESTAMP is present and if we can successfully read heartbeat data, it indicates that the previous shutdown was abnormal, i.e. we didn't execute our normal shutdown cleanup code.

For some reason lastalive0.dat and lastalive1.dat at C:\windows\ServiceProfiles\LocalService\AppData\Local were not getting deleted while doing a clean shut down/Reboot.

Many cases show that Blackberry Service can cause the problem. Because Blackberry Services putting a handle lastalive file and not releasing it during shutdown process.

According to the System Information, I found that Blackberry Service is running.
Please check the following path and see if there are files called LastAlive0 or LastAlive1: C:\windows\ServiceProfiles\LocalService\AppData\Local folder. If so, please stop or disable the Blackberry Services before next time you start the server, or you can contact the company of Blackberry and see if there is an update of the service to fix this problem.

I am also having this issue. At first I was concerned as this is running on an email server and the last thing you want is a dirty shutdown potentially causing further problems down the line.

I also think suggesting the Shutdown Event Tracker (SET) should be disabled is NOT a workaround to the issue. The OP clearly posted what the issue was and suggesting it should be disabled is poor advice.

The only time this should ever be suggested is when the initial SET is appearing before a reboot. This problem is whereby you fill in the first SET and then you are presented with another after reboot. There is obviously a reason for it and until it is resolved, how do you know something more serious isn't going to occur as a result of ignoring it?

However, since looking into this issue, in my case I am using RDP and BESE on the email server and I thought I would add my findings.

In an attempt to work out what is causing it, I manually stopped all the BlackBerry services from top to bottom in the list and then rebooted. I completed the first SET and after it did reboot and I logged on, I got no SET.

So in my case, and possibly those who are also running BESE, this sounds like an issue I've found elsewhere whereby the BB software is not cleanly stopping itself and leaving Windows to deduce an improper shutdown occurred. However, it sounds like RIM have no fix and might not have even acknowledged this as an issue as yet.

I am having the same issue on one of our servers - which is usually just restarted due to windows update. All other servers - same procedure - do not exhibit this behaviour...

Same issue as outlined by all others above.  Server generates a 6008 whether rebooted via RDP or console session, with blackberry services stopped, server reboots cleanly.

Observed on SBS 2011 Std: All MS patches applied

Exchange server 2010 v. 14.01.0218.013

Blackberry Enterprise Server Express 5.0.2.29

Any solutions found that do not require disabling a feature intended to notify admins when there really is a problem?

I have this problem as well and I agree that disabling the notification is just about the worst "Answer" I've read coming from a Microsoft employee.

Similar to what was already mentioned by a previous poster, this started for me on a single server immediately following a domain migration. The server used to be a domain controller in the previous domain but now is just a member server in the new domain. I have other servers that went through the same process, DC in old domain -> member server in new domain, and they don't have this issue.

OS: 2008 Standard SP2 32 bit

Hardware: Dell PowerEdge T410

Roles/Software: File and Print server

Are you running BES on this system as well?  Even though I can be critical of Microsoft, this is not their problem if you are.  It is RIM's.

I've got the issue on a server (it's a 2008 R2 DC, now with SP1, the issue existed before and after the SP1 update) which has never had Blackberry services installed onto it.

The issue occurs whether the reboot is remote (through RDP) or local (VMware ESX console - the machine is a VM on a vSphere 4.1 cluster).

Regardless of whether RIM software is involved or not, the incorrect behaviour is with a core Microsoft function, and so it IS Microsoft's problem, and NOT RIM's.

As an system application developer, I can tell you it IS RIM's fault.  Services have to respond to system shutdown messages and properly release resources and clean up files.  They are not doing that.  It is your responsibility as a service developer to handle these situations.  The problem is not in the core Microsoft function, but in the incorrect use of it by an application.

Your problem is obviously different than the BES problem which many in this thread have experienced.

I have the exact same thing but experience this on our Terminal Servers which are all installed with Windows 2008 R2 Standard and recently have been upgraded with Service Pack 1. The problem existed before installing Service Pack 1 and now also after Service Pack 1 is installed it is still there.

We ofcourse cannot have that the first user who logs on receives the shutdown message especially after we have performed maintenance or installed updates otherwise these servers should not restart. We do use RES PowerFuse on this system but even without that installed I still experience the problem.

We deploy our servers using SCCM 2007 SP2 R3 and the image itself is hosted on VMWare, the image itself does not experience this problem but all rolled out servers do. If I use the same installation media used to create the image and manually install a server I can reboot it as much as I want and the problem does not appear.

So far I think we can all conclude many people experience this problem but we all have different configurations and different installation methods. I seriously think it is something inside Windows that somehow is triggered but why or how... It still appears even if I manually restart the server and enter a valid message in the shutdown tracker, rebooting it through shutdown.exe command line also has the same effect.

As an system application developer, I can tell you it IS RIM's fault.  Services have to respond to system shutdown messages and properly release resources and clean up files.  They are not doing that.  It is your responsibility as a service developer to handle these situations.  The problem is not in the core Microsoft function, but in the incorrect use of it by an application.

Your problem is obviously different than the BES problem which many in this thread have experienced.

Correct and the Easy fix is as Follows. If you are Running BES on Server 2k8 R2

Open Group Policy Editor on the Local BES server

Expand to Shutdown Scripts

gpedit.msc

Computer Config

  Windows Settings

    Scripts

      Shutdown

Create a new Script

Script Name

net

Script Parameters

stop "BlackBerry Controller"

Effectively now when you shutdown your server it shuts down the offending Service first. There might be neat scripts but i find this quick and easy. No need to write a script frist and loose it on your disk somewhere.

• Proposed as answer by neocodesoftware Thursday, November 24, 2011 2:43 AM

• Edited by simdoc Tuesday, September 13, 2011 5:23 PM

I'm having the same problem with the tracker once I login to any of my 2008 R2 servers, and it happens across physical and virtual systems, even when I manually shutdown and supply a reason.

 

@Kevin

So far as your time sync issue, double check that VMware Tools isn't set to synchronize the servers time with the vSphere Host.

 

Regards,

M

I am experiencing this same issue on two freshly installed Win 2008 R2 servers running as VMs under vSphere 4.1. I do not have any Blackberry services installed. The only thing I've done on both are to run the security wizard, install sophos antivirus, update the vmware tools, install KBOX client. Will have to see if any of those cause the issue. If anyone else notices this and has a similar setup please let me know what you've discovered.

• Edited by Dorena Wednesday, January 04, 2012 12:23 AM

• Edited by Threonine Thursday, January 12, 2012 7:09 PM

Hi Threonine,

I spent several hours today trying to discover what was causing this. I still have a little more work to do but it looks to be the KACE Agent. Let me know what you find if you shut off the service using msconfig or uninstall it.

UPDATE: There is a confirmed bug with the KACE Agent and Windows 2008 R2. They are planning to have it resolved with a new release.

Dorena

• Edited by Dorena Thursday, January 19, 2012 10:37 PM

I assume you meant

net stop "BlackBerry Controller"

Yes.  If you use a shutdown scirpt enter:

Script Name:  net

Script Parameters:  stop "BlackBerry Controller"

Hello Dorena,

I also run a KACE and after reading your post I decided to create a shutdown script via GPO:

Script Name:  net

Script Parameters:  stop "Dell KACE Agent"

And it works perfectly!

-Robert

I just confirmed this with another server.  I installed windows updates and it started show up on a new server.  It happened after one of these updates.  If I get a chance I may try and uninstall some of them and see which one it is.

• Edited by bguy_1986 Thursday, August 09, 2012 8:20 PM

This just starting happening on a Server 2008 R2 Hyper-V guest running on the same OS host. It has been perfect for 12 months prior to last night, when I installed updates KB2729094 and KB2647753. It happened on the restart prompted by the updates, then on a second restart to test if it repeated itself.

The error appears to be erroneous so I'm reluctant to roll back updates on an otherwise functional production server, especially when it seems unlikely they would be the cause of the problem.

The server is running SQL Server 2008, Teamviewer and Shadowprotect. No AV software or BB software is present. It is a HP ML350 G6 fully updated and patched, it has other Server 2008 R2 guests that don't present the error.

Rather than disable the Shutdown Event Tracker, a Blackberry service tech recommended the following solution to this shutdown/restart problem:

[1] Edit the "Default Domain Controllers Policy"

[2] Edit the "Computer Configuration / Policies / Windows Settings / Scripts (Startup/Shutdown) / Shutdown" properties.

[3] From the "Scripts" tab, add a new shutdown script.

[4] Set the "Script Name" to "net" and set the "Script Paramenters" to "stop "blackberry controller" "

[5] Voila!  Now when the SBS shutsdown or restarts, no more "The previous system shutdown was unexpected" errors.

Hope this helps others in a similar situation.

Keith

If using VMWare, check if you have enabled VM Monitoring in Cluster properties. Also check tasks/events in virtual machine trough VCenter Console.

I found this was happening because VMWare was resetting (hard reset) the machine as vmware tools didn't start after 2 minutes from reboot. You may have to increase this time or even disable VM Monitoring.

• Edited by RobKoelmans Saturday, June 14, 2014 8:36 AM

By now, I'm sure it was a fake dialogue message, because it should have been in Dutch. We forced the message again and it was and there was no text at all beneath the Ok and Cancel buttons, let alone nonsense in that context about periodically necessary reboots.

I have a windows 2008 R2 server, which was configured and installed by a 3rd party vendor.  EVerytime the server is rebooted, we are prompted to supply the reason for the unexpected shutdown.  It's a dell server and Dell openmanage indicates a normal shutdown/restart. In combing through the event logs i find this error message "The Windows Management Instrumentation Service has detected an inconsistent system shutdown.

I've googled this and not found a lot of info.  I am at a loss as where to begin my troubleshooting.  Any direction is appreciated.

Not sure if this help for you,but   try

check in bios.

there is one option called ASR (Automatic System recovery) which will be enabled on HP servers by default and

As this is dell server definately there will be similar to ASR enabled on DELL.

if this option is enabled you may experience unexpected shutdown or restart. you need to diable if it is enabled.