No announcement yet.

Windows 2003 restarts

  • Filter
  • Time
  • Show
Clear All
new posts

  • Windows 2003 restarts

    My Windows 2003 Server restarts at 1:00am everyday -HELP!

    The following is logged in the event view.

    The process winlogon.exe has initiated the restart of computer <computer name> on behalf of user <domain>\Administrator for the following reason: No title for this reason could be found
    Reason Code: 0x800000ff
    Shutdown Type: restart

    Have scanned for viruses and nothing was found. Any suggestions?????

  • #2
    Looks like the password of Administrator is known somewhere. So, change it and see what happens.

    Also, the audit log may show where this is coming from.


    • #3
      Is it exactly 1:00am? I would change you admin password and check for scheduled tasks or any backups or processes that may attribute this.
      Server 2000 MCP
      Development: ASP, ASP.Net, PHP, VB, VB.Net, MySQL, MSSQL - Check out my blog

      ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **


      • #4
        reset password.... problem still occurs


        • #5
          Not surprisingly enough, there is more to this problem than meets the eye. Take a look at what's installed on this box, and let's perform some basic problem diagnosis.

          When did this first occur? Look at the Event Viewer, and let's see what that says. If you have more info, then post it, if not...

          Let's see what is active on this box, and what can be ended. What services run automatically, and what applications are designated to run automatically, or be granted service rights.

          You've changed the administrator account password. How many administrators are there? Why do they all exist? (Remember you're looking for some form of common thread between the reboots, and something unusual or out of place on that box)

          If you can disconnect the box from the network one evening, then do so. Let's see if it still restarts. If you can't do that, then create a new administrator account, and test it. If it works, then logon, and DISABLE every other administrator account, and see what happens the next night. One thing is for sure, this is linked to someone, or some application or other internal or external trying to gain access to the system, and perform some function or other (And I mean more than simply shutdown)

          Have a think and get back to me and I'll try to assist further.



          • #6
            Sounds like a scheduled reboot that my friend. Check your processes. Whats happening around the time it happens?
            UK Newbie!


            • #7


              It could be that a service is configured in the "Recovery" tab, to restart the system on first failure, and that some other process causes the service to stop (a batch file?).

              Try to check in this direction also.

              Did you check scheduled tasks?

              Did you try to disable or change schedule of the backup software?

              Other programs that schedule actions?

              Automatic updates?

              Did you check the Event logs (all logs!) to see what happens just before the restart?