I mean, it's being awfully nice about it and all. Each and every time it seems like it's a graceful shutdown.
Windows 2003 R2 server. (SP2)
HP Proliant DL380 G4. (BIOS current as of 2007.)
Xeon dual-core proc (3.2 G)
4 GB RAM.
Running:
* Altiris NS and management server
* SQL Server 2000 SE (SP4)
* IIS
According to the security and system log, a domain service account with local admin privs is rebooting the box, with this entry in the log. (It even gives a reason, that nice little account! :)
(And not only that, but the only other account that's logged in/connected happens to.. ahem, be my admin account.)
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 6/3/2009
Time: 11:34:48 AM
User: N/A
Computer: altiris-server
Description:
Application popup: System Shutdown : The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by mydomain\altiris-server-account. Shutdown will begin in 1 seconds. Shutdown message: Performing System Maintenance.
(WTF? `Performing System Maintenance'? What system maintenance would that be, little service account?)
The domain service account, (mydomain/altiris-server-account) is local admin on the box, and running the following Altiris services:
Altiris Client Message Dispatcher
Altiris Client Task Data Loader
Altiris Deployment Server Data Manager
Altiris Deployment Server DB Management
Altiris eXpress Server
Altiris NS Receiver
Altiris Object Host Service
Altiris PXE Manager
Altiris Service
...as well as the following SQL services:
MSSQLSERVER
SQLSERVERAGENT
I'm completely stymied. No scheduled tasks are performing any obvious reboots, nothing shows in displaying "at" on the local box.. Nothing else appears to be scheduled in an application, other than some Altiris stuff.
This sounds like you have an advertised job running that reboots the machine. Check within altiris itself to see if it has a job that would do this and if it might be advertised to the server on a recurring basis.
Ah. After much gnashing of teeth and troubleshooting, it appeared that during a maintenance period when I ran a remote, "psshutdown" command on the server, it somehow held on to the temporary service that psshutdown creates and kept re-running it over and over. What confused me was the fact that when I would shut down for the day, it roughly corresponded to shutdown times on the server.
Weird.
Anyway, thanks to all for great answers, much appreciated..
Has someone possibly created a scheduled task under the service user account that tells the system to reboot? We were having major issues with IIS refusing to server up pages after a few days, so we created a scheduled task to restart IIS services every so often. I'm wondering if something similar is happening to you, except that it is set up to reboot the server.