Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 R2 Server that switchs off on his own. and it does not look like a hardware problem since I can see in the log how all services are stopped and after:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          28/12/2011 01:19:49
Event ID:      109
Task Category: (103)
Level:         Information
Keywords:      (4)
User:          N/A
Description:
The kernel power manager has initiated a shutdown transition.

And:

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          28/12/2011 01:19:50
Event ID:      13
Task Category: None
Level:         Information
Keywords:      
User:          N/A
Description:
The operating system is shutting down at system time ‎2011‎-‎12‎-‎28T01:19:50.956025700Z.

What could be the problem?

UPDATE:

There is no UPS. It is not a virtual machine.

I have switched now from "Balanced" to "high performance" to see what happens.

This is the event sequence:

Information 28/12/2011 01:19:50 Kernel-General  13  None
Information 28/12/2011 01:19:49 Kernel-Power    109 (103)
Information 28/12/2011 01:19:49 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:48 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:47 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 Service Control Manager 7036    None
Information 28/12/2011 01:19:46 UserPnp 20010   (7010)

Before the UserPnP event, there is an event from 4 hours before. All those "7036" are "the XXX service entered stopped state"

Probably it does not explain anything, but this is the UserPnp event:

Log Name:      System
Source:        Microsoft-Windows-UserPnp
Date:          28/12/2011 01:19:46
Event ID:      20010
Task Category: (7010)
Level:         Information
Keywords:      
User:          SYSTEM
Description:
One or more of the Plug and Play service's subsystems has changed state. 

PlugPlay install subsystem enabled: 'false' 
PlugPlay caching subsystem enabled: 'false' 
share|improve this question
1  
Is the server on a UPS? Is it losing power? Have you looked at the powercfg settings on the server? Is it configured to shutdown on battery power if AC power is lost? –  Ryan Ries Dec 28 '11 at 14:53
    
Is this a virtual machine? –  gravyface Dec 28 '11 at 15:09

4 Answers 4

Probably not the answer but a contribution. Found the same error in a couple of virtual servers, after an uptime alarm, and could see all services being stopped nicely and found that 109 was an entry after a planned reboot from Citrix service event ID 1074

Log Name:      System
Source:        USER32
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Description:
The process C:\Program Files (x86)\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe 
               has initiated the restart of computer <COMPUTERNAME> 
               on behalf of user NT AUTHORITY\SYSTEM for the following 
               reason: Application: Maintenance (Planned)
 Reason Code: 0x80040001
 Shutdown Type: restart
share|improve this answer
    
I got the same errors as the OP and after looking through events prior to restart, it appeared that another tech did initiate a reboot, so looking for event id 1074 prior to shutdown can help determine who is restarting machine. The server was vmware server. –  Volodymyr Sep 9 '13 at 11:14

Usually this is due to automatic updates. Both the 109 and 13 Event IDs can indicate a reboot. Look for update messages in the event log from WindowsUpdateClient, for example:

enter image description here

...

enter image description here

Also, if someone pressed the power button that can initiate a graceful shutdown with many systems.

share|improve this answer
    
@ChrisS: Both those events 109 and 13 will appear during a windows update reboot. Don't blame me, I didn't write them ;-) –  Kyle Brandt Dec 28 '11 at 15:02
    
+1 I stand corrected; I could have swore the 109 code read something about a reboot when WAU was bouncing the system, but these are indeed the exact messages. Now thinking there's a BIOS/ACPI bug that turns the server off instead of rebooting it. –  Chris S Dec 28 '11 at 15:05
    
humm.. interesting, but I didn't see any WU event there –  NullOrEmpty Dec 28 '11 at 18:34

Have you considered the possibility of someone simply hitting the power button ? That will cause exactly the behavior you described.

share|improve this answer

We've got a same problem here. Hope our steps help to solve similar problems.

We have a hyper-v stand-alone with 2x Server 2008 R2 as VM installed.

By searching the internet we found some hands-on:

  1. Windows activation key (if it's expired, it could be give such a problems.. don't ask me why...)
  2. Outdated drivers
  3. Shutdown - HyperV - energy problems

What we did

  1. It was a brand new server, so hasn't a key yet. We put a activation key in and activated both O/S
  2. With Hyper-V Integration Service cd we'd update the virtual drivers
  3. I disabled the "what to do when powerbutton preshed" in energy manager.
  4. My Computer>Properties>Advanced System Settings> Startup and Recovery Settings> Disable "Automatically restart"

Now the server didn't shutdown itself for a couple of days. I hope it will stay working now for a while:)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.