Windows Shutdown Unexpectedly

[kalyse]

I am having serious problems on a few servers. Actually 6 of them to be precise.

 

I have 7 servers in total all identical specs

 

Dul Core 3Ghz Xeons

4GB RAM

 

Now, on 6 of the 7 servers I have TCA Installed and all of them have continuous Unexpected Shutdowns.

 

1 of the server is doing itonce every 10 minutes (as of this morning)

and 6 of them are doing it randomly, although usually about once a day.

 

The longest I have had any server up for in about 4 months is 5 days. I have installed updates on all servers and all the servers are still rebooting.

 

Now I have just bought 2 new servers last week and of these two servers I haven't goten round to installing TCA on both, although on one of them, the one that doesnt have TCA installed, it still has not crashed and unexpectedly shutdown.

 

What can people suggest for securing the system from this problem?

 

I am not sure what the problem could be. I am assuming its just a coinsidence that the server without TCA hasnt crashed and belive TCA is not the cause.

 

What would you advise?

[kalyse]

I checked the event log and the IDs are:

 

1021

1076

[Scott]

Any instances of lsass.exe in your eventlogs? After one of these reboots, what are you seeing through vnc/rdc?

[kalyse]

Not that I can see, 1076 I believe is just the Shutdown Event Log also.

 

 

Im really stooped here. The main priority is the server thats constantly rebooting.

[jonbiloh]

Probably the Windows 2003 rdp bug showing up. There are hot fixes to fix this available.

[kalyse]

Know where I can get them from?

[Defcon|Rich]

Windows update?

[24play1]

this still ongoing?

[Daersun]

create a batch file called stopthemadness.bat with this command

shutdown -h

login and start patchign windows

click the bat before the shutdown happens

[HIS-MOTHER]

That or go into your services and find Remote procedure call./ Properties/ events. Under the actions tell it all 3 times to take NO ACTION if this service fails.

[Defcon|Rich]

Have you checked the event logs after the servers reboot to see what's causing this?

 

You might uncheck "Automatic Reboot from error" as a start.

 

 

 

I doubt it has anything to do with tcadmin since many others would show this problem also.

 

 

If you need assistance shoot me a PM, I'd be happy to have a look for you.

 

 

 

Thanks

[24play1]

That or go into your services and find Remote procedure call./ Properties/ events. Under the actions tell it all 3 times to take NO ACTION if this service fails.

 

my thoughts also

[alpha98]

also had a machine doing this, just started doing it this week, rebooting itself about once every other day.

 

changed the actions to 'no action' for the RPC properties as suggested above. hope this stops the rebooting, automatic updates etc are turned off, so how could something have changed allow this to start happening ?

[Monk]

Make sure you have full memory dumps on, then attach a debugger and see what's causing the issues.. it's probably a panic/bsod.

[Tom22]

i have the same problem on an atlanta server however its escalated and is pritty much deleting its self now ive had to remove all teamspeaks from it (i got it online for 20 mins woot before it crashed again)

 

would you guys suggest a full os reinstall or just trying to get it to update because it crashes on everything lol.

[ECF]

Backup and reload to another server. This could be hardware related, and you of course do not want to reload a nice new install on a bad machine.

[Tom22]

its not hardware all fresh been over that changed ram and disks sadly gonna have to do a complete reinstall as the server has locked up and we cant gain access anymore.

[ECF]

Could be a bad motherboard, chipset etc... you can never really tell.