User32 ..EVENTID 1074 winlogon initiated restart of server
One of my server hosting Hub and Client Access is having restart on everyday 7 AM. The Event viewer details are as follows:-
Please send me a reason for this kind of restart. I need to avoid this restart as my exchange will be down and sometime the restart is not proper and I cannot RDP to this server but pinging is fine to this server IP.
Event Type:
Information
Event Source:
USER32
Event Category:
None
Event ID:
1074
Date:
11/24/2011
Time:
7:00:00 AM
User:
NTDOMAIN\Administrator
Computer:
EXCHHTCA
Description:
The process winlogon.exe has initiated the restart of computer EXCHHTCA on behalf of user NTDOMAIN\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x840000ff
Shutdown Type: restart
Comment:
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 84
ÿ..„
November 27th, 2011 9:36am
Check the security log, also I'd try changing the NTDOMAIN\Administrator password
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Free Windows Admin Tool Kit Click here and download it now
November 27th, 2011 9:51am
Hello,
Please see that: http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=1074&EvtSrc=User32&LCID=1033
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft Student
Partner 2010 / 2011
Microsoft Certified
Professional
Microsoft Certified
Systems Administrator: Security
Microsoft Certified
Systems Engineer: Security
Microsoft Certified
Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified
Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft Certified
Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft Certified
IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer
November 27th, 2011 5:41pm
Thanks for the reply Dave and X.
Dave .. I will go for that only as a last method. Firstly I need to figure out from where these scheduled restart generating.
It is exactly on every day 7:00 AM except on fridays. So I hope somewhere some restart script generated to do it in rightly fashion.
The main problem for me is sometime this startup itslef is not in a proper way and it will stuck in halfway that we can ping to it but no RDP. Even in direct monitor connection it will blank screen and none of the sevices will be started
so my exchange gets screwed, I need to rush to office to have a force restart manually.
Please let me know if anymore updates from you guys
Free Windows Admin Tool Kit Click here and download it now
November 27th, 2011 10:40pm
The restart is being initiated with the NTDOMAIN\Administrator account credentials. The security log may provide details. If you don't know who or what script is doing this then I'd change the password to stop it.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
November 27th, 2011 10:47pm
Dave
What you said was right, it is the domain admin account initiating the restart. When I reset the ntdomain\administrator password this scheduled task was gone and my exchange cluster now working without any issue.
Free Windows Admin Tool Kit Click here and download it now
December 9th, 2011 10:51am
I had another issue related to backup. When restarting the admin password one of my backup hanged and I need to stop it.
Later any backup on exchange was having error of writer status, which I blogged and find it was because of cancel pending status remains as it is and sometime it may take hours to clear the state.
So I found 2 otherways, one is to dismount/mount database or restart the Information store service.
I did the second one and backup started without any issue and first it goes to consistency check and it took almost a day to finish the consistency check and started the backup process. But in the middle of the back it again goes to consistency check and
for 2 days it wa running as it stuck in that state.
Is there any way to sort this issue. I am sure its related to the hanging and cancel of exchange backup. Rest all my other backup with Symantec Backupexec 2010 is working fine.
Only problem is with the Exchange server backup. Is it any way to solve this consistency check issue.
MYy EDB database is 246 GB and exchnage is a cluster of 3 server (Hub/Client Acces, Mailbox1, Mailbox2)
Waiting for your comments
December 9th, 2011 11:13am
Might ask them here about this issue.
http://social.technet.microsoft.com/Forums/en-US/category/exchangeserver/
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Free Windows Admin Tool Kit Click here and download it now
December 9th, 2011 8:16pm
Dave
What you said was right, it is the domain admin account initiating the restart. When I reset the ntdomain\administrator password this scheduled task was gone and my exchange cluster now working without any issue.
Good to hear this.
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
December 9th, 2011 8:17pm