# [SOLVED] Server Randomly Shuts Down



## nhammen09

This started happening about 3 days ago. The server will be running fine, and then it will gracefully shut down for anywhere from 2-5 hours and then it will come back up and will be fine for the rest of the day. The timing appears to be random and the time length is random as well. Even log shows that there are a few processes that initiate this, but there's no comment.

The process C:\Windows\system32\winlogon.exe (SERVERNAME) has initiated the power off of computer SERVERNAME on behalf of DOMAIN\nickh for the following reason: no title for this reason could be found
Reason code: 0x500ff
Shutdown Type: power off
Comment: 

Yesterday, it was down for 2 hours and 15 minutes, before it was 6 hours, and before that it was 3 hours. One for sure was called by svhost which I think is automatic updates. It only seems to happen between 8am and noon, but there are no scheduled tasks and nothing unusual running in msconfig or registry. There is also nothing in the startup program. The system isn't overheating according to SpeedFan. Some forums suggested a faulty power supply. I've tested that as well and found no issues with a PSU tester. The server is plugged into a UPS, and it hasn't generated any events that I'm aware of. Spiceworks shows that the last power event for it was almost 3 months ago. I'm at a standstill and can't find anything useful to help troubleshoot this. Any ideas? Logs available upon request.

Note: The SERVERNAME and DOMAIN have been masked for security purposes.

System is running Windows Server 2008 R2 SP1
Asus M4n68T-V2 motherboard w/ 8GB RAM
AMD Athlon II 3-core processor
WD 7200rpm 1TB SATA hard drive
2 NIC cards

Let me know if you need anymore details.


----------



## Wand3r3r

*Re: Server Randomly Shuts Down*

It would appear nickh [you?] is shutting down the server. Disable nickh's account and see if the shutdowns continue.


----------



## nhammen09

*Re: Server Randomly Shuts Down*

The nickh account is the primary domain administrator. During the times the shutdown is occurring, nobody is logged on. It also appears that it is calling from winlogon.exe. The only thing I can think of is that the UPS may not be passing power correctly and windows shuts down to prevent data loss?


----------



## Wand3r3r

*Re: Server Randomly Shuts Down*

The error is specific. By disabling the account whatever process is shutting the system down will fail to shut it down and will generate a error in the event viewer log.

If no one is logged on than odds are you assigned this user to a service [improper procedure] and its that service shutting down the system.

If it was the ups it would have to initiate a shutdown script and would do so not due to "passing power" but it detected a power loss which results in the shutdown script activating.


----------



## nhammen09

*Re: Server Randomly Shuts Down*

Update: I ran a test yesterday by having that user logged in 24hrs via RDP and monitored logs. It didn't shutdown at anytime yesterday. I also verified the services and they are all set to logon as either Local System or Network Service. Also, while reviewing the logs more, I found the same error that was called by NT AUTHORITY\System for a shutdown with error 0x500ff. I also found 3 events in the time of the shutdowns from the Kernel-Power-Manager.

The kernel power manager has initiated a shutdown transition.
Event 109 Kernel-Power

Since it didn't shutdown yesterday, and is so far so good today with constant logon, I really can't pinpoint the problem for sure. I'm sure it is related to the user account, but if possible, I'd like to resolve it without disabling the account.


----------



## Wand3r3r

*Re: Server Randomly Shuts Down*

You do have other domain admin accounts don't you? You should always have admin back doors into the system.

error 0x500ff means system failure according to Microsoft but MS provides no hints on the cause.

I would be preparing for catastrophic system failure. Make sure you have tested as good backups.


----------



## nhammen09

*Re: Server Randomly Shuts Down*

So far so good, the system hasn't shutdown in a few days, but I did make sure that the server image is current and has tested properly in case of a failure. Also, I do have one other domain admin account that can be used in case of emergency or lockout that has equivalent permissions to this current account.

Strangely, this problem hasn't reoccurred in a few days. Not sure if that's good or ominous, but the image is current and the backup is being taken and tested daily just to be safe.


----------



## Wand3r3r

*Re: Server Randomly Shuts Down*

Sounds like you are prepared which is good. Thanks for the update.


----------

