Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having problems with a server that has been restarting itself randomly for the past 3 months. The server is windows 2003 with SP2 Domain Controller and it is fully patched.

I have seen the following errors in event log:

Source: USER32

Category: None

Type: Information

Event ID: 1074

User: Domain\Administrator

The process winlogon.exe has initiated the restart of computer (server name) on behalf of user domainname\Administrator for the following reason: No title for this reason could be found

Reason Code: 0x840000ff

Shutdown Type: restart

I have ran out of ideas as to what might be causing this issue. The system is clean and not infected. There are no scheduled tasks responsible for the restart either.

I'm considering moving the backup (Backup Exec 12.5) to a different server but I'm almost certain that this is not the issue as the restart times vary and do not match the scheduled backup jobs.

Any suggestions to help me resolve this issue would be appreciated, thanks.

share|improve this question
look in the security event logs see where the domain\administrator is logged in from its either interactive or remote if remote find out whats going on on the remote device around the relevant time. – tony roth Jul 19 '10 at 16:42
who down voted this and for what reason? – tony roth Jul 20 '10 at 0:26
Are one or more services configured to run as domain\administrator? If so, I would strongly suggest giving each service its own service account. – Skyhawk Oct 16 '12 at 3:01

What you're seeing there is an orderly shutdown triggered by a local or remote process running as "Administrator". You should use your Security Event Log (with "Audit logon events" for success enabled) to track down where the logon is coming from. If it's a local process then you may be able to use "Process tracking" to further track down the source of the shutdown request.

share|improve this answer

Are there any policies set to update and reboot automatically?

Who else has the administrator password? Have you changed the password recently so only you know it?

Anything with antivirus updates that would cause a reboot after it initiates an update of definitions?

share|improve this answer
The server is only restarted based on a scheduled task on Monday nights. Only administrators know the admin password. Symantec Endpoint Protection Manager, as well as Symantec Endpoint are installed on this server. I don't believe the definition updates restart the server. I also haven't seen any option in Symantec Endpoint that points to the server requiring a restart. So I guess I'm back at square one. – PCTech Jul 19 '10 at 16:44

Could be a service is running using the administrator account credentials and is causing issues.

As has been asked already, have you changed the admin password since it started happening?

If not, try that first and make sure you know exactly who knows the password and what they are doing when they accesss the server then see how it goes.

edit: Also check that scheduled task to make sure it doesnt have multiple schedules. The fact that task exists makes me very suspicious that somehow it is causing the problems.

share|improve this answer

It's automatic updates. Go to Windows Update and configure it to download, but not install until you say so.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.