Announcement

Collapse
No announcement yet.

Server 2003 randomly reboot

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Server 2003 randomly reboot

    Hello team,

    I'm having issue with my exchange 07 on Win2k3 and MS SQL box on win2k3. It randomly reboot during work hour.

    On the Even View "Security" It show most of it is User: NT Authority\System logon with even ID 562.

    How do I figure out what is trigger the reboot? itz not the windows update that I know for sure.

    Thanks,
    HN

  • #2
    Re: Server 2003 randomly reboot

    Assuming this is not the intended behaviour of another application other than windows update that does have access to the system account id assume this may be virus related behaviour. Check the logs to see what events precede the restart. Scan both boxes for malware/viruses/greyware etc. Can you provide any more detail for both boxes? Is there a discernible pattern (time of day? User logged on interactively?) or are both boxes restarting completely sporadic?

    Comment


    • #3
      Re: Server 2003 randomly reboot

      That is what I'm concerning about if I have virus or my network been hack.
      I have officescan for antivirus. what do you guys recommend for the AV to scan the network?

      Thanks,
      HN

      Originally posted by scurlaruntings View Post
      Assuming this is not the intended behaviour of another application other than windows update that does have access to the system account id assume this may be virus related behaviour. Check the logs to see what events precede the restart. Scan both boxes for malware/viruses/greyware etc. Can you provide any more detail for both boxes? Is there a discernible pattern (time of day? User logged on interactively?) or are both boxes restarting completely sporadic?

      Comment


      • #4
        Re: Server 2003 randomly reboot

        Is this two separate servers or one box running both Exchange and SQL?

        For AV checking, download as many offline tools as you can (e.g. McAfee Stinger) and burn to some bootable media e.g. WinPE

        Boot the server from media and scan with multiple engines, then, if viruses found, keep offline until you do the same to the rest of your network.

        Also, since it is an older server (I presume), consider hardware errors -- workload goes up and e.g. processor thermal cut off trips, and server resets. Check any hardware logs and if you have any monitoring facilities, look into what that shows. Consider opening it and removing dust, checking failed fans etc.
        Last edited by Ossian; 17th November 2011, 18:33.
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment


        • #5
          Re: Server 2003 randomly reboot

          I think the auto update did it.. I turn it off and monitor it for awhile..

          Thanks,
          HN

          Originally posted by Ossian View Post
          Is this two separate servers or one box running both Exchange and SQL?

          For AV checking, download as many offline tools as you can (e.g. McAfee Stinger) and burn to some bootable media e.g. WinPE

          Boot the server from media and scan with multiple engines, then, if viruses found, keep offline until you do the same to the rest of your network.

          Also, since it is an older server (I presume), consider hardware errors -- workload goes up and e.g. processor thermal cut off trips, and server resets. Check any hardware logs and if you have any monitoring facilities, look into what that shows. Consider opening it and removing dust, checking failed fans etc.

          Comment

          Working...
          X