I logged on to my domain controller today to find the following event logged in my event viewer
Event Type: Warning Event Source: USER32 Event Category: None Event ID: 1073 Date: 3/19/2012 Time: 2:39:32 PM User: DOMAIN\administrator Computer: SERVER Description: The attempt by user DOMAIN\Administrator to restart/shutdown computer SERVER failed For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: Words 0000: 773e4880
I've scrolled back through my logs and found a few instances of this in the past couple of days but I have no idea why they're happening. The server doesn't reboot but I find it concerning that the administrator account seems to be issue commands to reboot when there's no way someone would be issuing that command (in the middle of the day).
I've done some research and found THIS Page describing that it may be because of visual studio being left open when logging off. This server DOES have visual studio installed but I tried logging off with it open and it did not produce the event viewer log.
Has anyone experienced this? Is this a cause for concern??