Software

I have heard nothing about doing an online scan, checking of running resources, or any diags on the hardware.

Have a look in the "event viewer" on each of the computers that is restarting - ie Control Panel > Administrative Tools > Event Viewer
It may give you an indication of why the computer is restarting.

Did they all start to "restart" at the same time or different times? If the same time did you load some software onto these computers around that time?

Do you have automatic windows updates running?

Some of the Windows updates have been known to cause restart problems.


Do all the computers get updated with the same and latest virus and anti spyware programs?

Does it happen in SAFE mode.

also can try this

Start Windows XP in Safe mode, and then configure Windows to not automatically restart when a STOP error occurs. To do this, follow these steps:
To restart the computer in Safe Mode when the POST process completes, press F8.
On the Windows Advanced Options menu that appears, use the ARROW keys to select Safe Mode, and then press ENTER.
Select the operating system to start, and then press ENTER.
Log on to the computer as Administrator, and then click Yes in the Windows is running in safe mode dialog box that appears.

NOTE: When the computer is running in Safe mode, your display settings may be set to a lower resolution than you expect.
Click Start, and then click Control Panel.
Click Switch to Classic View if Control Panel is not already in Classic View.
Double-click System, click the Advanced tab, and then under Startup and Recovery, click Settings.
Under System failure, click to clear the Automatically restart check box.
Click OK twice.
Close Control Panel, and then restart Windows normally.

I support your quest for knowledge or answer. In the small office where I work, this was a regular feature even though Norton and McAfee were available and up to date. My unit and that of a Secretary had Win 2K and the rebooting was occuring sometimes thrice a day. At a point we THOUGHT that the problem was due to instability on "one phase" of our power supply system, until I read your enquiry.
The only difference in my case is that I have nothing to do with "Citrix client v 9.0". All the PCs in question are standalones. Mine has an internet connection but not the secretary's.
I hope I have contributed to this debate adequately.

Ben

In my company, the bugcheck/reboot issue was caused by Norton AntiVirus scanning a particular (malformed) file in the Temporary Internet Files folder from an otherwise innocuous website. Do a google on the bugcheck hexcode.

have you checked the eventlog to see if there is any clue as to what is causing it, if there is a wmi type converstation causing it, it would be in the eventlog. if the computer was restarted due to a windows update, it should also be in there.

You said that you applied all the updates for Windows 2000. I have a PC that is running 2000 and Citrix and we haven't applied the compined patch, Update Rollup 1 for Windows 2000 SP4, because there is a known problem with that patch and Citrix. I don't know if that helps or not but you can try uninstalling that patch and see if the same problem occurs.

Typical trojan and bot infections over the last year have caused intermittant rebooting of PCs via open TCP port 445. I would recommend blocking all TCP traffic on port 445 both incoming and outgoing along with confirming application of MS updates MS04-011 and MS03-026. Some MS processes such as the scheduler use 445 on a network, so you might need to open this port up to specific IP addresses if required. Some new variants of trojans such as Esbot and Spybot do this. Look for processes being started on your PCs like: mousebm.exe and .exe (Esbot), f2n{random number}.exe (Spybot), etc.