5

I have a Windows 2008 R2 Server that switchs off on his own. and it does not look like a hardware problem since I can see in the log how all services are stopped and after:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          28/12/2011 01:19:49
Event ID:      109
Task Category: (103)
Level:         Information
Keywords:      (4)
User:          N/A
Description:
The kernel power manager has initiated a shutdown transition.

And:

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          28/12/2011 01:19:50
Event ID:      13
Task Category: None
Level:         Information
Keywords:      
User:          N/A
Description:
The operating system is shutting down at system time ‎2011‎-‎12‎-‎28T01:19:50.956025700Z.

What could be the problem?

UPDATE:

There is no UPS. It is not a virtual machine.

I have switched now from "Balanced" to "high performance" to see what happens.

This is the event sequence:

Information 28/12/2011 01:19:50 Kernel-General  13  None
Information 28/12/2011 01:19:49 Kernel-Power    109 (103)
Information 28/12/2011 01:19:49 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 UserPnp 20010   (7010)

Before the UserPnP event, there is an event from 4 hours before. All those "7036" are "the XXX service entered stopped state"

Probably it does not explain anything, but this is the UserPnp event:

Log Name:      System
Source:        Microsoft-Windows-UserPnp
Date:          28/12/2011 01:19:46
Event ID:      20010
Task Category: (7010)
Level:         Information
Keywords:      
User:          SYSTEM
Description:
One or more of the Plug and Play service's subsystems has changed state. 

PlugPlay install subsystem enabled: 'false' 
PlugPlay caching subsystem enabled: 'false' 
NullOrEmpty
  • 379
  • 2
  • 5
  • 16
  • 1
    Is the server on a UPS? Is it losing power? Have you looked at the powercfg settings on the server? Is it configured to shutdown on battery power if AC power is lost? – Ryan Ries Dec 28 '11 at 14:53
  • Is this a virtual machine? – gravyface Dec 28 '11 at 15:09
  • Ours *was* a Virtual Machine with this weird message - however it was simply a case of having SCCM reboots suppressed, but with Windows Updates accidentally enabled on the server. – PeterX Jan 27 '15 at 06:24

6 Answers6

3

Usually this is due to automatic updates. Both the 109 and 13 Event IDs can indicate a reboot. Look for update messages in the event log from WindowsUpdateClient, for example:

enter image description here

...

enter image description here

Also, if someone pressed the power button that can initiate a graceful shutdown with many systems.

gravyface
  • 13,947
  • 16
  • 65
  • 100
Kyle Brandt
  • 82,107
  • 71
  • 302
  • 444
  • @ChrisS: Both those events 109 and 13 will appear during a windows update *reboot*. Don't blame me, I didn't write them ;-) – Kyle Brandt Dec 28 '11 at 15:02
  • +1 **I stand corrected**; I could have swore the 109 code read something about a reboot when WAU was bouncing the system, but these are indeed the exact messages. Now thinking there's a BIOS/ACPI bug that turns the server off instead of rebooting it. – Chris S Dec 28 '11 at 15:05
  • humm.. interesting, but I didn't see any WU event there – NullOrEmpty Dec 28 '11 at 18:34
3

Probably not the answer but a contribution. Found the same error in a couple of virtual servers, after an uptime alarm, and could see all services being stopped nicely and found that 109 was an entry after a planned reboot from Citrix service event ID 1074

Log Name:      System
Source:        USER32
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Description:
The process C:\Program Files (x86)\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe 
               has initiated the restart of computer <COMPUTERNAME> 
               on behalf of user NT AUTHORITY\SYSTEM for the following 
               reason: Application: Maintenance (Planned)
 Reason Code: 0x80040001
 Shutdown Type: restart
gideon
  • 1,135
  • 2
  • 13
  • 28
Mor
  • 31
  • 1
  • I got the same errors as the OP and after looking through events prior to restart, it appeared that another tech did initiate a reboot, so looking for event id 1074 prior to shutdown can help determine who is restarting machine. The server was vmware server. – Volodymyr Molodets Sep 09 '13 at 11:14
1

We've got a same problem here. Hope our steps help to solve similar problems.

We have a hyper-v stand-alone with 2x Server 2008 R2 as VM installed.

By searching the internet we found some hands-on:

  1. Windows activation key (if it's expired, it could be give such a problems.. don't ask me why...)
  2. Outdated drivers
  3. Shutdown - HyperV - energy problems

What we did

  1. It was a brand new server, so hasn't a key yet. We put a activation key in and activated both O/S
  2. With Hyper-V Integration Service cd we'd update the virtual drivers
  3. I disabled the "what to do when powerbutton preshed" in energy manager.
  4. My Computer>Properties>Advanced System Settings> Startup and Recovery Settings> Disable "Automatically restart"

Now the server didn't shutdown itself for a couple of days. I hope it will stay working now for a while:)

udo
  • 287
  • 1
  • 6
  • 18
1

Have you considered the possibility of someone simply hitting the power button ? That will cause exactly the behavior you described.

Stephane
  • 6,382
  • 3
  • 25
  • 47
1

I also had same issue. I followed the answers shared by our experts in this forum and found event ID 1074 in the Windows System event log as follows -

The process C:\Windows\system32\wlms\wlms.exe (VIRTUALSERVER) has initiated the shutdown of computer VIRTUALSERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason Code: 0x80000000 Shutdown Type: shutdown Comment: The license period for this installation of Windows has expired. The operating system is shutting down.

The cause of restart was my license expired for Windows Server 2012 r2. I hope this helps someone else. It didn't bother me alot BTW.

I say Reinstate Monica
  • 3,100
  • 7
  • 23
  • 51
-1

If motherboard is changed and auto shutdown problem if you're faced.

Windows activation key (if it's expired, it could be give such a problem).

Windows activation is required.

Amol
  • 1