One of my server hosting Hub and Client Access is having restart on everyday 7 AM. The Event viewer details are as follows:- Please send me a reason for this kind of restart. I need to avoid this restart as my exchange will be down and sometime the restart is not proper and I cannot RDP to this server but pinging is fine to this server IP. Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 11/24/2011 Time: 7:00:00 AM User: NTDOMAIN\Administrator Computer: EXCHHTCA Description: The process winlogon.exe has initiated the restart of computer EXCHHTCA on behalf of user NTDOMAIN\Administrator for the following reason: No title for this reason could be found Reason Code: 0x840000ff Shutdown Type: restart Comment: For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: ff 00 00 84 ÿ..„

Check the security log, also I'd try changing the NTDOMAIN\Administrator password Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]

Hello, Please see that: http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=1074&EvtSrc=User32&LCID=1033 This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

Thanks for the reply Dave and X. Dave .. I will go for that only as a last method. Firstly I need to figure out from where these scheduled restart generating. It is exactly on every day 7:00 AM except on fridays. So I hope somewhere some restart script generated to do it in rightly fashion. The main problem for me is sometime this startup itslef is not in a proper way and it will stuck in halfway that we can ping to it but no RDP. Even in direct monitor connection it will blank screen and none of the sevices will be started so my exchange gets screwed, I need to rush to office to have a force restart manually. Please let me know if anymore updates from you guys

The restart is being initiated with the NTDOMAIN\Administrator account credentials. The security log may provide details. If you don't know who or what script is doing this then I'd change the password to stop it. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]

Dave What you said was right, it is the domain admin account initiating the restart. When I reset the ntdomain\administrator password this scheduled task was gone and my exchange cluster now working without any issue.

I had another issue related to backup. When restarting the admin password one of my backup hanged and I need to stop it. Later any backup on exchange was having error of writer status, which I blogged and find it was because of cancel pending status remains as it is and sometime it may take hours to clear the state. So I found 2 otherways, one is to dismount/mount database or restart the Information store service. I did the second one and backup started without any issue and first it goes to consistency check and it took almost a day to finish the consistency check and started the backup process. But in the middle of the back it again goes to consistency check and for 2 days it wa running as it stuck in that state. Is there any way to sort this issue. I am sure its related to the hanging and cancel of exchange backup. Rest all my other backup with Symantec Backupexec 2010 is working fine. Only problem is with the Exchange server backup. Is it any way to solve this consistency check issue. MYy EDB database is 246 GB and exchnage is a cluster of 3 server (Hub/Client Acces, Mailbox1, Mailbox2) Waiting for your comments

Might ask them here about this issue. http://social.technet.microsoft.com/Forums/en-US/category/exchangeserver/ Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]

Dave What you said was right, it is the domain admin account initiating the restart. When I reset the ntdomain\administrator password this scheduled task was gone and my exchange cluster now working without any issue. Good to hear this. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]