Can someone explain to me what caused my server reboot?

Home Forums Server Operating Systems Windows Server 2012 / 2012 R2 Can someone explain to me what caused my server reboot?

This topic contains 3 replies, has 2 voices, and was last updated by Avatar Ossian 3 weeks, 4 days ago.

Viewing 4 posts - 1 through 4 (of 4 total)
  • Author
    Posts
  • Avatar
    Sagharbi
    Participant
    #626605

    Event Viewer System logs showing the following:
    Event id: 1074
    Source: User32
    Reason Code: 0x80020002
    The process C:\Windows\system32\svchost.exe has initiated the restart of computer xxxxx on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Recovery (Planned)

    Avatar
    Ossian
    Moderator
    #626645

    The message suggests a manual reboot – if you didnt do it, ask anyone else who might have, and consider the possibility your server has been attacked.

    Avatar
    Sagharbi
    Participant
    #626651

    Thanks Ossian. I googled the reason code 0x80020002 and from what I’ve read, it’s a windows update reboot. This was also confirmed by the WindowsUpdate.log file. My understanding is if it was a user that rebooted it, it would show “on behalf of user ‘username'” not “on behalf of user NT AUTHORITY\SYSTEM”. What makes you believe it was a manual reboot?

    Avatar
    Ossian
    Moderator
    #626670

    From the reason given – I was under the impression that system initiated reboots didnt give one, but could well be wrong.

    Updates seems a reasonable excuse for an automatic reboot, but you can disable them in group policies

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.