Unexplained reboots - Win2003 SP2 - The process winlogon.exe has initiated the restart of computer

Discussion in 'Windows Server' started by KayZer sOZE, Nov 14, 2008.

  1. KayZer sOZE

    KayZer sOZE Guest

    I have serveral Win2003 SP2 (64 bits, std, enterprise, everything) and all
    of then are rebooting without anyone using it. They´re very stable and it
    happens after some days with a WSUS Patch installed but without a reboot
    (reboot pending). Nobody is choosing "reboot" and if a RDP connection is
    made, the "reboot later" choice is always choosed and at the tima of the
    reboos, nobody was using the Servers


    The Error in the Event Viewer:


    Event Type: Information
    Event Source: USER32
    Event Category: None
    Event ID: 1074
    Date: 11/14/2008
    Time: 4:42:52 PM
    User: NT AUTHORITY\SYSTEM
    Computer: HDS-SRV-04
    Description:
    The process winlogon.exe has initiated the restart of computer HDS-SRV-04 on
    behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for
    this reason could be found
    Reason Code: 0x80020002
    Shutdown Type: restart
    Comment:

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 02 00 02 80 ...?




    The WSUS log:

    2008-11-14 16:42:52:156 928 7c8 AU WARNING: Initiating reboot since no user
    logged on
    2008-11-14 16:42:52:156 928 7c8 AU AU invoking RebootSystem (OnRebootNow)
    2008-11-14 16:42:52:281 928 7c8 Misc WARNING: SUS Client is rebooting
    system.
    2008-11-14 16:42:52:281 928 7c8 AU AU invoking RebootSystem (OnRebootRetry)
    2008-11-14 16:42:52:281 928 7c8 AU AU rebooting machine since no user is
    logged on and reboot is required.
    2008-11-14 16:42:58:890 928 7c8 AU ########### AU: Uninitializing
    Automatic Updates ###########
    2008-11-14 16:42:59:546 928 7c8 Service ** END ** Service: Service exit
    [Exit code = 0x240001]
     
    KayZer sOZE, Nov 14, 2008
    #1
    1. Advertisements

  2. I have serveral Win2003 SP2 (64 bits, std, enterprise, everything) and all
    That does not seem normal. Are you sure no backdooring happened here
    or someone got access to your machine? Have you done a malware check
    with Spybot to make sure the system is clean?

    - Thee Chicago Wolf
     
    Thee Chicago Wolf, Nov 14, 2008
    #2
    1. Advertisements

  3. KayZer sOZE

    Dave Patrick Guest

    Dave Patrick, Nov 16, 2008
    #3
  4. KayZer sOZE

    KayZer sOZE Guest

    Here we have TREND AV, 100% updated


     
    KayZer sOZE, Nov 17, 2008
    #4
  5. Here we have TREND AV, 100% updated

    For kicks, install and run Spybot.

    - Thee Chicago Wolf
     
    Thee Chicago Wolf, Nov 18, 2008
    #5
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.