Home / server / Questions / 344691
In Process
NullOrEmpty
Asked: 2011-12-29 06:39:32 +0800 CST

Windows 2008 Server R2 turns itself off

  • 772

I have a Windows 2008 R2 Server that switchs off on his own. and it does not look like a hardware problem since I can see in the log how all services are stopped and after:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          28/12/2011 01:19:49
Event ID:      109
Task Category: (103)
Level:         Information
Keywords:      (4)
User:          N/A
Description:
The kernel power manager has initiated a shutdown transition.

And:

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          28/12/2011 01:19:50
Event ID:      13
Task Category: None
Level:         Information
Keywords:      
User:          N/A
Description:
The operating system is shutting down at system time ‎2011‎-‎12‎-‎28T01:19:50.956025700Z.

What could be the problem?

UPDATE:

There is no UPS. It is not a virtual machine.

I have switched now from "Balanced" to "high performance" to see what happens.

This is the event sequence:

Information 28/12/2011 01:19:50 Kernel-General  13  None
Information 28/12/2011 01:19:49 Kernel-Power    109 (103)
Information 28/12/2011 01:19:49 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 UserPnp 20010   (7010)

Before the UserPnP event, there is an event from 4 hours before. All those "7036" are "the XXX service entered stopped state"

Probably it does not explain anything, but this is the UserPnp event:

Log Name:      System
Source:        Microsoft-Windows-UserPnp
Date:          28/12/2011 01:19:46
Event ID:      20010
Task Category: (7010)
Level:         Information
Keywords:      
User:          SYSTEM
Description:
One or more of the Plug and Play service's subsystems has changed state. 

PlugPlay install subsystem enabled: 'false' 
PlugPlay caching subsystem enabled: 'false'
electrical-power windows-server-2008-r2 acpi

6 Answers

  1. Usually this is due to automatic updates. Both the 109 and 13 Event IDs can indicate a reboot. Look for update messages in the event log from WindowsUpdateClient, for example:

    enter image description here

    ...

    enter image description here

    Also, if someone pressed the power button that can initiate a graceful shutdown with many systems.

    • 3

  2. Probably not the answer but a contribution. Found the same error in a couple of virtual servers, after an uptime alarm, and could see all services being stopped nicely and found that 109 was an entry after a planned reboot from Citrix service event ID 1074

    Log Name:      System
Source:        USER32
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Description:
The process C:\Program Files (x86)\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe 
               has initiated the restart of computer <COMPUTERNAME> 
               on behalf of user NT AUTHORITY\SYSTEM for the following 
               reason: Application: Maintenance (Planned)
 Reason Code: 0x80040001
 Shutdown Type: restart
    • 3

  3. We've got a same problem here. Hope our steps help to solve similar problems.

    We have a hyper-v stand-alone with 2x Server 2008 R2 as VM installed.

    By searching the internet we found some hands-on:

    1. Windows activation key (if it's expired, it could be give such a problems.. don't ask me why...)
    2. Outdated drivers
    3. Shutdown - HyperV - energy problems

    What we did

    1. It was a brand new server, so hasn't a key yet. We put a activation key in and activated both O/S
    2. With Hyper-V Integration Service cd we'd update the virtual drivers
    3. I disabled the "what to do when powerbutton preshed" in energy manager.
    4. My Computer>Properties>Advanced System Settings> Startup and Recovery Settings> Disable "Automatically restart"

    Now the server didn't shutdown itself for a couple of days. I hope it will stay working now for a while:)

    • 1

  4. Have you considered the possibility of someone simply hitting the power button ? That will cause exactly the behavior you described.

    • 1

  5. I also had same issue. I followed the answers shared by our experts in this forum and found event ID 1074 in the Windows System event log as follows -

    The process C:\Windows\system32\wlms\wlms.exe (VIRTUALSERVER) has initiated the shutdown of computer VIRTUALSERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason Code: 0x80000000 Shutdown Type: shutdown Comment: The license period for this installation of Windows has expired. The operating system is shutting down.

    The cause of restart was my license expired for Windows Server 2012 r2. I hope this helps someone else. It didn't bother me alot BTW.

    • 1

  6. If motherboard is changed and auto shutdown problem if you're faced.

    Windows activation key (if it's expired, it could be give such a problem).

    Windows activation is required.

    • -1