5

We have a fleet of AWS EC2 instances running Windows Server. Since moving from Windows Server 2012r2 to 2016, we've encountered an issue where a server is shut down for unknown reasons. After an exhaustive inspection of event logs, the only consistency appears to be the following:

The process C:\Windows\system32\winlogon.exe ([computername]) has initiated the power off of computer [computername] on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: power off

We've considered and theoretically ruled out the following:

  1. Windows Updates issue

    • No updates were running according to event logs or Get-WindowsUpdateLog. Sconfig > "Windows Update Settings" is set to DownloadOnly
  2. Power button toggle, or hardware/battery issue

    • This is an AWS EC2 instance and we've never experienced this with any 2012r2 or 2012 servers. If it was hardware related surely it would affect all server versions.
  3. Windows Server license expiration

    • These servers are licensed correctly according to "slmgr.vbs /dlv", and the shutdowns have happened at 39, 62, and 188 days after their initial turn-on.
  4. With old versions of mstsc there is a power button displayed on the logon screen, which can be used to turn off the system in this manner

    • This theory is largely based on this post but to be clear that is for a 2012 server, and we're on 2016. I have also not been able to repro this at all.

Does anyone have any idea what could be causing this shutdown? Or, any idea how we could go about finding more information? I've looked through every log file and event log I can find. There is also no dmp file corresponding to the time of shutdown.

  • Because the shutdown request is coming from winlogon.exe and the local system account, it pretty much has to be either someone shutting it down at the logon screen (via the virtual console, or perhaps via RDP in edge cases) or by pushing the (virtual) power button. Shutting down at the logon screen is disabled by default on server operating systems, but you might double-check that setting. As to the power-button option, have you asked Amazon support about this? – Harry Johnston Apr 10 '19 at 23:10
  • ... actually that post you link to says that on their servers powering down from the console was enabled by default, so you really should check that setting. – Harry Johnston Apr 10 '19 at 23:14
  • 1
    Does stopping the instance from the EC2 console result in the same information being logged? That should look like a power off. – Michael - sqlbot Apr 11 '19 at 3:14
  • @HarryJohnston I haven't been able to reproduce the power button on the logon/lock screen using a variety of old mstsc's, but that option appears to actually be enabled. We were hoping to repro before configuring a GPO to disable it, but perhaps the time has come. – Nathan Apr 11 '19 at 14:36
  • @Michael-sqlbot No - I tested that and the shutdown is a different type. – Nathan Apr 11 '19 at 14:37
3

The Reason Code says that it's a BlueScreen (SHTDN_REASON_MAJOR_SYSTEM | SHTDN_REASON_MINOR_BLUESCREEN)

Reference: https://docs.microsoft.com/fr-fr/windows/desktop/Shutdown/system-shutdown-reason-codes

You should check that your drivers/softwares are up-to-date. Don't forget to check your antivirus too, because it's possible that an outdated third-party antivirus can lead to bluescreens.

You can use BlueScreenView to help you analyzing BSOD memory dumps (if any).

  • That sounds equally reasonable and troublesome, as these instances were built from recent AMIs. As an aside, looking at that link I'm unclear on how reason code combinations work. The reason code from our event is 0x500ff whereas the reason code for SHTDN_REASON_MAJOR_SYSTEM is 0x00050000 and SHTDN_REASON_MINOR_BLUESCREEN is 0x0000000F. If we add them, we'd get 0x5000F, which is close but not exact. What am I missing to get the extra F? – Nathan Apr 10 '19 at 19:31
  • 0x500ff just means a user-initiated shutdown. – Harry Johnston Apr 10 '19 at 23:08
  • 1
    @HarryJohnston can you explain how you're able to determine that from MS documentation? – Nathan Apr 11 '19 at 13:38
  • It is documented as a bug here but they seem to have decided to just leave it that way, since even the latest version of Windows 10 does the same thing. No documentation that I can find, but that's how it is. – Harry Johnston Apr 11 '19 at 18:58
  • @HarryJohnston Ah, thanks! I saw that link before but did not properly contextualize it as the same incorrect reason code we're seeing, mostly because we're not seeing two 1074 events - just one. We're going with this theory though, have created and linked a GPO to shutoff the power button, and will update this question with our results. – Nathan Apr 11 '19 at 19:31
0

We followed advice from the comment of @HarryJohnston and created a GPO to disable the option to shutdown a server from the lock screen. The specific policy is:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options > Shutdown: Allow system to be shut down without having to log on > Disabled

Since doing this a month ago we have seen no unexpected shutdowns (and were seeing about one per week previously). It is still strange to me that AWS's default Windows Server 2016 AMI would have this option enabled, and that it would actually be accessible from somewhere, but that seems to have been the case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.