Windows 2008 Server R2 turns itself off

Question

I have a Windows 2008 R2 Server that switchs off on his own. and it does not look like a hardware problem since I can see in the log how all services are stopped and after:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          28/12/2011 01:19:49
Event ID:      109
Task Category: (103)
Level:         Information
Keywords:      (4)
User:          N/A
Description:
The kernel power manager has initiated a shutdown transition.

And:

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          28/12/2011 01:19:50
Event ID:      13
Task Category: None
Level:         Information
Keywords:      
User:          N/A
Description:
The operating system is shutting down at system time ‎2011‎-‎12‎-‎28T01:19:50.956025700Z.

What could be the problem?

UPDATE:

There is no UPS. It is not a virtual machine.

I have switched now from "Balanced" to "high performance" to see what happens.

This is the event sequence:

Information 28/12/2011 01:19:50 Kernel-General  13  None
Information 28/12/2011 01:19:49 Kernel-Power    109 (103)
Information 28/12/2011 01:19:49 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 UserPnp 20010   (7010)

Before the UserPnP event, there is an event from 4 hours before. All those "7036" are "the XXX service entered stopped state"

Probably it does not explain anything, but this is the UserPnp event:

Log Name:      System
Source:        Microsoft-Windows-UserPnp
Date:          28/12/2011 01:19:46
Event ID:      20010
Task Category: (7010)
Level:         Information
Keywords:      
User:          SYSTEM
Description:
One or more of the Plug and Play service's subsystems has changed state. 

PlugPlay install subsystem enabled: 'false' 
PlugPlay caching subsystem enabled: 'false'

Is the server on a UPS? Is it losing power? Have you looked at the powercfg settings on the server? Is it configured to shutdown on battery power if AC power is lost? — Ryan Ries, Dec 28 '11 at 14:53
Ours *was* a Virtual Machine with this weird message - however it was simply a case of having SCCM reboots suppressed, but with Windows Updates accidentally enabled on the server. — PeterX, Jan 27 '15 at 06:24

score 3 · Answer 1 · edited Dec 28 '11 at 15:09

3

Usually this is due to automatic updates. Both the 109 and 13 Event IDs can indicate a reboot. Look for update messages in the event log from WindowsUpdateClient, for example:

enter image description here

...

enter image description here

Also, if someone pressed the power button that can initiate a graceful shutdown with many systems.

edited Dec 28 '11 at 15:09

gravyface

13,947
16
65
100

answered Dec 28 '11 at 14:51

Kyle Brandt

82,107
71
302
444

@ChrisS: Both those events 109 and 13 will appear during a windows update *reboot*. Don't blame me, I didn't write them ;-) – Kyle Brandt Dec 28 '11 at 15:02
+1 **I stand corrected**; I could have swore the 109 code read something about a reboot when WAU was bouncing the system, but these are indeed the exact messages. Now thinking there's a BIOS/ACPI bug that turns the server off instead of rebooting it. – Chris S Dec 28 '11 at 15:05
humm.. interesting, but I didn't see any WU event there – NullOrEmpty Dec 28 '11 at 18:34

score 3 · Answer 2 · edited Mar 06 '12 at 05:19

Probably not the answer but a contribution. Found the same error in a couple of virtual servers, after an uptime alarm, and could see all services being stopped nicely and found that 109 was an entry after a planned reboot from Citrix service event ID 1074

Log Name:      System
Source:        USER32
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Description:
The process C:\Program Files (x86)\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe 
               has initiated the restart of computer <COMPUTERNAME> 
               on behalf of user NT AUTHORITY\SYSTEM for the following 
               reason: Application: Maintenance (Planned)
 Reason Code: 0x80040001
 Shutdown Type: restart

I got the same errors as the OP and after looking through events prior to restart, it appeared that another tech did initiate a reboot, so looking for event id 1074 prior to shutdown can help determine who is restarting machine. The server was vmware server. — Volodymyr Molodets, Sep 09 '13 at 11:14

score 1 · Answer 3 · edited Jun 04 '13 at 10:22

We've got a same problem here. Hope our steps help to solve similar problems.

We have a hyper-v stand-alone with 2x Server 2008 R2 as VM installed.

By searching the internet we found some hands-on:

Windows activation key (if it's expired, it could be give such a problems.. don't ask me why...)
Outdated drivers
Shutdown - HyperV - energy problems

What we did

It was a brand new server, so hasn't a key yet. We put a activation key in and activated both O/S
With Hyper-V Integration Service cd we'd update the virtual drivers
I disabled the "what to do when powerbutton preshed" in energy manager.
My Computer>Properties>Advanced System Settings> Startup and Recovery Settings> Disable "Automatically restart"

Now the server didn't shutdown itself for a couple of days. I hope it will stay working now for a while:)

score 1 · Answer 4 · answered Jun 04 '13 at 07:58

1

Have you considered the possibility of someone simply hitting the power button ? That will cause exactly the behavior you described.

answered Jun 04 '13 at 07:58

Stephane

6,382
3
25
47

score 1 · Answer 5 · edited May 23 '17 at 21:54

I also had same issue. I followed the answers shared by our experts in this forum and found event ID 1074 in the Windows System event log as follows -

The process C:\Windows\system32\wlms\wlms.exe (VIRTUALSERVER) has initiated the shutdown of computer VIRTUALSERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason Code: 0x80000000 Shutdown Type: shutdown Comment: The license period for this installation of Windows has expired. The operating system is shutting down.

The cause of restart was my license expired for Windows Server 2012 r2. I hope this helps someone else. It didn't bother me alot BTW.

score -1 · Answer 6 · answered Sep 21 '18 at 14:41

-1

If motherboard is changed and auto shutdown problem if you're faced.

Windows activation key (if it's expired, it could be give such a problem).

Windows activation is required.

answered Sep 21 '18 at 14:41

Amol

1

Windows 2008 Server R2 turns itself off

6 Answers6