Networks

Ask something
Question Locked

Restarting shuts machine down

0 helpful
25 replies

by kim_forbes 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,

I have had an issue where after performing maintenance on a server 2003 machine running SP1, selecting restart actually shuts the machine down. I know it is rare to shut down a server, but would greatly like to avoid having to workaround this issue. It seems as though the machine jsut cleanly shuts down, nothing in event logs to point to a BSOD or similar..

I am restarting the machine remotely, which means that I have to use a RAC to boot it after this happens. Not the most favourable way to manage this.

Does anyone have any solutions?

May this also affect any other aspect of the machine (i.e could this be a power issue that may have other unexpected side-effects)? I have had no other issues with this machine up til now. It is a poweredge machine running standard server 2003.

Any info or advice would be much appreciated, as I can find no evidence of this or any similar issue with MS.

25 replies

by rob miners

sure on this one but I can suggest a couple of things to check if you have'nt already done so.

Check Temperatures
Check all Fans
Check PSU
Check Voltages
Check the Capacitors

Let us know how you get on.

by the scummy one

next time to reboot try typing the command

shutdown.exe /r

It appears that reg entry for the shutdown command may have been altered. So, try it from the command line first. Does it work?

If so, you can create a batch file and put it on the desktop until the reg key can be fixed

by kim_forbes

Hi guys,

Thanks for the responses. Aftyer extensive testing, all components of the system seem fine (memory, HDD, fans, CPU, cache, fans, etc etc), so I am poretty sure it leads to a software error.

Scummy, I tried the reboot command via a batch file and viola! Worked a treat...but this is not a very good fix, as if any other guys in the IT team here fail to use it they are boned. I don't really want to give them access to the RAC either, so a solution to this issue is what I am aiming for.

Does anyone know the registry key where I can find this shutdown.exe mod?

Also, the batch file I used was:
shutdown.exe /t 30 /r /f
So I am wondering whether the additional options (time to reboot and force app close) have any bearing on this.

thanks all

by the scummy one

cause I dont have a svr03 system running. I beleive other
options are needed for svr03 (like telling it its a patch, or
scheduled maintenance) so it is likely to have a whole other
set of switches and reg entries than XP.

I agree, this was only given as a short term fix, and to test.
Since it works, the reg entry must be the problem.

by sleepin'dawg

Be prepared for lots of reading.
Maybe you could also use search function

by kim_forbes

Perhaps something like "shutdown"?

I am looking into this and the structure of the 2003 registry...thanks dawg...

All helpful posts, thank you all,

TrueBlue, part of my system tests were to check the file system (sfc) and all appeared fine. Nothing new installed on the server - it was build around a year ago and immediately set up at our site after thereafter. Do not really want to update the BIOS remotely, either, hence why I'm hoping a registry setting/key addition may fix this issue. I have heard wind around that there is a key for this, but jsut can't find any info anywhere.

I have located the key "powerdownafterrestart", which more often than not has to be added to the registry from my research, so there has to be some way to do it.

If you think of anything else, let me know guys? If I can find a solution I will post it to add to this Q&A for future reference if needed.

Your input has been very helpful and I assume will continue to be so.

Best Regards,

by the scummy one

I was browsing the registry and it hit me. The shutdown command works fine, however the start menu button does not. That means that the start button pointer is pointing incorrectly.
So, I decided to look through start menu options instead. There is an option (on XP) to Set Program Access and Defaults.
maybe un-checking, applying and re-checking, and applying may fix the problem.

Another problem file or entry may be with shell32.dll, however, I am not a developer so I do not know too much about changing .dll files

by rob miners

I just checked the Registry on my SBS Server and there is no reference to shutdown.exe.
I checked the settings in XP and followed the path in SBS but it was nowhere to be found.
There has to be a reference somewhere that runs this feature.
Edit:
Check your BIOS settings.
If there is a BIOS update available install it.
If new Drivers or Sofware has been installed roll it back.
Run sfc /scannow

by rob miners

something as simple as the profile that you are using. When you create Administrative Profiles do you copy the Main Administrator like I always do or do you create a User and add Permissions? Try it with another profile and see what happens. I have actually had this happen but after a restart it didn't happen again. But then again I was at the PC at the time.
As Scummy said it has to be something simple, I think it is something simple as well.

by kim_forbes

Hi True,

thanks for following this up for me mate. After a bit more testing (which I must admit is a little restricted due to the location of the machine), i.e different profiles, searching the registry, etc this is still an issue we are affected by. I thought this may have been an issue provoked by an upgrade of our backupexec software, and agents pertaining to, but after speaking with Symantec (which was a job in itself let me tell you) they have advised this is not the case...

I have just been holding my breath and putting off restarting the machine.

Did i also tell you that I cannot run the shutdown command from the command line? Which is quite odd - i can run it fine from a batch file - but have had to name the batch file "exit.bat". If it is named "shutdown.bat" and schedlued to run at a certain time it fails to run?!

Myself and my manager are the only ones who interact with the opeating system on the machine so I'm at a loss as to why this issue is occurring. It is also a standardised image that we roll out to server machines - all of which are identical and none of which else are getting these symptoms.

I appreciate all your dilligent assistance and recommendations.

Happy Easter all

by rob miners

It had the same name as the program you're trying to run in the batch, and you probably didn't specify the file extension when calling it. EG: shutdown.exe

What do you get if you go to a command line at the C:\ prompt and type in

shutdown /? |more

Does it display the help?

You have a Happy Easter too

by kim_forbes

I would have thought that I would not need the extension, even when calling it in the command prompt as it is an executable file. This is not the case?

But yes, it had the same name as the service it is calling (i.e originally I called it "shutdown.bat") and this did not work at all.

the script is:
c:\windows\system32\shutdown.exe /r /f /t30

I have just now changed the name to runonce.bat, and have redirected the scheduled task to run this at 10pm tonight, for testing purposes.

With my research I have seen examples of other sys admins getting this issue and their workaround has been to run the service in a batch file. I noted that they also had to name the bat file something other than the service name (i.e not shutdown.bat), so methinks once again your advice is correct.

I will keep you posted true

by kim_forbes

I would have thought that I would not need the extension, even when calling it in the command prompt as it is an executable file. This is not the case?

But yes, it had the same name as the service it is calling (i.e originally I called it "shutdown.bat") and this did not work at all.

the script is:
c:\windows\system32\shutdown.exe /r /f /t30

I have just now changed the name to runonce.bat, and have redirected the scheduled task to run this at 10pm tonight, for testing purposes.

With my research I have seen examples of other sys admins getting this issue and their workaround has been to run the service in a batch file. I noted that they also had to name the bat file something other than the service name (i.e not shutdown.bat), so methinks once again your advice is correct.

I will keep you posted true

by kim_forbes

I would have thought that I would not need the extension, even when calling it in the command prompt as it is an executable file. This is not the case?

But yes, it had the same name as the service it is calling (i.e originally I called it "shutdown.bat") and this did not work at all.

the script is:
c:\windows\system32\shutdown.exe /r /f /t30

I have just now changed the name to runonce.bat, and have redirected the scheduled task to run this at 10pm tonight, for testing purposes.

With my research I have seen examples of other sys admins getting this issue and their workaround has been to run the service in a batch file. I noted that they also had to name the bat file something other than the service name (i.e not shutdown.bat), so methinks once again your advice is correct.

I will keep you posted true

by rob miners

and see if it is the same as mine.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoRestartShell"=dword:00000001
"DefaultDomainName"="XXXX"
"DefaultUserName"="XXXXX"
"LegalNoticeCaption"=""
"LegalNoticeText"=""
"PowerdownAfterShutdown"="0"
"ReportBootOk"="1"
"Shell"="Explorer.exe"
"ShutdownWithoutLogon"="0"
"System"=""
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"SfcQuota"=dword:ffffffff
"allocatecdroms"="0"
"allocatedasd"="0"
"allocatefloppies"="0"
"cachedlogonscount"="10"
"forceunlocklogon"=dword:00000000
"passwordexpirywarning"=dword:0000000e
"scremoveoption"="0"
"AllowMultipleTSSessions"=dword:00000001
"AppSetup"=""
"UIHost"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6c,00,\
6f,00,67,00,6f,00,6e,00,75,00,69,00,2e,00,65,00,78,00,65,00,00,00
"DebugServerCommand"="no"
"SFCDisable"=dword:00000000
"WinStationsDisabled"="0"
"ShowLogonOptions"=dword:00000001
"AltDefaultUserName"="XXXX"
"AltDefaultDomainName"="XXXXXO"
"AutoAdminLogon"="0"
"DisableLockWorkstation"=dword:00000000
"CachePrimaryDomain"="XXXX"
"DCacheUpdate"=hex:c2,46,ef,fa,70,90,c8,01
"SyncForegroundPolicy"=dword:00000001

by kim_forbes

this now. thanks for your help True

I have found a key for:
MyComputer\HKEY_USERS\(Profile)\Software\Windows\CurrentVersion\Explorer\shutdown setting.

The value of this key is DWord=0x00000004(4)
From the research I have done over the weekend, the value 4 should not exist for this key, only 0 to 3, based on how the machine responds to the shutdown command. If the value 4 does not exist as a DWord value, then I am hoping this may be the primary cause.

Further to this, the key for shutdown Setting should only exist in the HKLM \SOFTWARE \Microsoft \Windows NT \CurrentVersion \Shutdown path, and not HKLU path I referenced above.

Does this sound abnormal, and as though it may be where my issue lies?

I will keep you posted after I get the chance to test this theory.

Thanks once again mate

On a final note with this post, my [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon keys were slightly different to yours, as I am running 2003 SP1. All values to pertaining keys looked the same however. I think we are on the right track here mate

Best Regards,

by rob miners

has the value 4 as well in that area.

Is your value the same as this
"PowerdownAfterShutdown"="0"

by kim_forbes

powerdownaftershutdown=0

It sounds pretty normal doesn't it?

I also don't have a key for HKLM \SOFTWARE \Microsoft \Windows NT \CurrentVersion \Shutdown \ShutdownSetting, which I should have according to research done.

Lastly, I was not able to find info on what the value "4" is in the aforementioned key. I assume it may be a hibernation or powersaving stage perhaps? a value of 3 should be a machine restart or power recycle (shutdown, then restart machine) - could it be that the machine is not shutting down but hibernating you think?

by rob miners

in the power settings and disable it if it is ticked.

I am runining Service Pack 2 that could explain the differences. Any particular reason for not installing Service Pack 2.

by kim_forbes

works in mysterious ways and keeps all this information to himself, so I am in the dark on a lot of issues. All our servers are standardised (when running w2k3 that is) with SP1, so it may be a standardisation issue. That and of course lack of testing with a migration to SP2. This is of course only speculation for now.

I have also been looking and musing on the power options for the server - there is no UPS service installed on the server itself , and I'm sure we are using a UPS for both servers we have down in the branch there. Do you think this may affect my problem in this way?

At the very least I think this would affect the server with a power outage, no?

Further to this, looking in the admin utility it seems the 2nd PSU on the server has failed.....

Any thoughts true?

by rob miners

could be the problem if the 2nd PSU on the server has failed. When you are restarting the PSU isn't kicking in for the restart. Replace it.

I would be running UPS on the Server.

by kim_forbes

speaking with my manager about this, it seems that the second PSU was not plugged in as there is a restriction with power connections down in the office there. Both servers we have down there are sharing a UPS, but it is just not installed as a service on the machines there.

So it seems it pertains to moreso a software setting, which does strike me as odd as such as I have mentioned before, they are ghosted server installs....

I will be looking moreso into this this coming weekend. I appreciate the efforts you are taking with these posts true.

Kim

by rob miners

sysprep to prepare the image. If it was a straight copy did you update the sids on the cloned PC.

This discussion is closed to new replies.