Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I logged on to my domain controller today to find the following event logged in my event viewer

Event Type: Warning
Event Source:   USER32
Event Category: None
Event ID:   1073
Date:       3/19/2012
Time:       2:39:32 PM
User:       DOMAIN\administrator
Computer:   SERVER
Description:
The attempt by user DOMAIN\Administrator to restart/shutdown computer SERVER failed

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data: Words 0000: 773e4880 

I've scrolled back through my logs and found a few instances of this in the past couple of days but I have no idea why they're happening. The server doesn't reboot but I find it concerning that the administrator account seems to be issue commands to reboot when there's no way someone would be issuing that command (in the middle of the day).

I've done some research and found THIS Page describing that it may be because of visual studio being left open when logging off. This server DOES have visual studio installed but I tried logging off with it open and it did not produce the event viewer log.

Has anyone experienced this? Is this a cause for concern??

share|improve this question
    
Do you have any services running under the Domain\Administrator account? Also, this might be a profile hive issue. Since you are on Windows 2K3 you might want to try this: microsoft.com/download/en/… –  murisonc Mar 19 '12 at 20:16
    
I've seen this happen with SQL Server Management studio. You have to be logged on as an administrator, and then logoff with SQL Management Studio still open. It won't generate the message unless you are administrator (as opposed to server operator or remote desktop user). –  Adam Thompson Mar 21 '12 at 20:56
    
I'm inclined to agree with you Adam on this actually. The warning message only ever pops up during business hours, and when a consultant has been in the server programming. I am having trouble replicating the issue but I will keep an eye on it. –  DKNUCKLES Mar 22 '12 at 12:55
add comment

1 Answer

up vote 1 down vote accepted

I realise this is an old question but in case anyone come across from google search:

On Win 2008 & 2008 R2 If you do a log off with a program open, & that program asks you if you want to save a file, the cancel logoff/force logoff screen appears. If you cancal on that screen eventid 1073 is logged to the system event log

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.