Windows 2003 Web Server shut down unexpectedly

Question

I hope this is the right Exchange to ask this:

On Saturday, our client's dedicated Windows 2003 Web Server suddenly shut down and was down for around ten hours while the hosting company restarted the machine several times, then replaced the power supply and finally put the drives into a new server. Looking through the event logs, it's obvious that someone/thing was trying to RDC into the server, with no luck, but could that actually take down a server? I ask because this isn't the first time this machine has shut down suddenly and with no apparent reason so I thought I'd ask. I don't see anything in the logs that looks odd aside from the constant RDC attempts, which get forcibly closed by the server, and you have to be at a certain IP address in order to have access in the first place, so it's really dumb for them to try.

Answer 1

The server wouldn't turn back on without swapping out the mobo, processor, RAM, power supplies, and controller (basically everything but the drives)?

I'd say this was a hardware issue, not software.

Answer 2

If the hardware is marginally defective (read: preexisting hardware issue) and the usual load on the machine is very low, then the additional load just from the requests COULD push the machine over ther edge. Eg a few Watts of extra power usage finally drive a power supply with weak filter caps into an undervoltage trigger, or a machine running zombie from the cache with a dead hard disk could try and swap out something vital to disk and ... splat.

Answer 3

Sounds like the hosting company should explain the root cause. They should also be handling the RDC "acl" on their firewall and not the server itself. This way you won't be getting those events logged at all, as non-approved source IPs will be blocked at the firewall like they should be instead of the server itself.