WS 2003 Shutdowns

Discussion in 'Server Setup' started by John Straumann, Jul 28, 2005.

  1. HI all:



    I just built a new box and put WS 2003 on it. I am getting some strange
    behavior and when I checked the system logs I see the messages shown below.
    I checked on the web and a lot of messages suggested this could be a worm
    like Sasser, however I have Etrust running and also ran some Sasser removal
    tools with no success. Also, I did one install, applied SP1, and got this
    behavior. I wiped that one out and did a new install without SP1 and I am
    seeing the same issues.



    Can anyone suggest some steps I can take to troubleshoot this?



    Thanks in advance for any and all help.



    John



    Log 1: The process winlogon.exe has initiated the restart of computer
    WINSERVER1 on behalf of user for the following reason: No title for this
    reason could be found

    Reason Code: 0x50006

    Shutdown Type: restart

    Comment: The system process 'C:\WINDOWS\system32\lsass.exe' terminated
    unexpectedly with status code -1073740972. The system will now shut down
    and restart.



    Log 2: Application popup: System Shutdown : The system is shutting down.
    Please save all work in progress and log off. Any unsaved changes will be
    lost. This shutdown was initiated by NT AUTHORITY\SYSTEM. Shutdown will
    begin in 58 seconds. Shutdown message: The system process
    'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status
    code -1073740972. The system will now shut down and restart..
     
    John Straumann, Jul 28, 2005
    #1
    1. Advertisements

  2. Hi,

    If you are installing the computer while it is connected to the network it
    can get infected before it is completely setup. It is enough that network
    driver is up and running.

    My suggestion would be to take computer offline, install if from beginning
    with SP1. Once installed enable firewall on network interface and connect it
    to the network. Go to Windows Update site and install all the remaining
    patches.

    You should also use antivirus and other tools that can look and remove
    malicious code from your computer.

    I hope this helps,
     
    Miha Pihler [MVP], Jul 28, 2005
    #2
    1. Advertisements

  3. John Straumann

    Robert Wolfe Guest

    Mike, I have also noticed that programs that monitor security tokens in
    real time (such as a recent network monitoring program I was using at one
    point) can also cause this type of reboot.
     
    Robert Wolfe, Jul 29, 2005
    #3
  4. Hi:

    No I am not running anything like that. This is just a lab machine so I
    reinstalled WS2003 with all patches and then reconnected to the 'Net. We'll
    see what happens.

    John.
     
    John Straumann, Jul 29, 2005
    #4
  5. Don't forget to turn on personal firewall on the network interface before
    the computer is fully patched. Simple thing like turning on the personal
    firewall can stop Worms from infecting the PC.
     
    Miha Pihler [MVP], Jul 29, 2005
    #5
  6. Hi

    <snip>

    Thanks Robert. There are quite a few things that can cause such problems. My
    current best bet is a worm or a virus -- but in the end it will be
    impossible to tell till we try to eliminate one problem at the time.
     
    Miha Pihler [MVP], Jul 29, 2005
    #6
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.