Unexplained reboots - Win2003 SP2 - The process winlogon.exe has initiated the restart of computer

[KayZer sOZE]

I have serveral Win2003 SP2 (64 bits, std, enterprise, everything) and all
of then are rebooting without anyone using it. They´re very stable and it
happens after some days with a WSUS Patch installed but without a reboot
(reboot pending). Nobody is choosing "reboot" and if a RDP connection is
made, the "reboot later" choice is always choosed and at the tima of the
reboos, nobody was using the Servers


The Error in the Event Viewer:


Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 11/14/2008
Time: 4:42:52 PM
User: NT AUTHORITY\SYSTEM
Computer: HDS-SRV-04
Description:
The process winlogon.exe has initiated the restart of computer HDS-SRV-04 on
behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for
this reason could be found
Reason Code: 0x80020002
Shutdown Type: restart
Comment:

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 02 00 02 80 ...?




The WSUS log:

2008-11-14 16:42:52:156 928 7c8 AU WARNING: Initiating reboot since no user
logged on
2008-11-14 16:42:52:156 928 7c8 AU AU invoking RebootSystem (OnRebootNow)
2008-11-14 16:42:52:281 928 7c8 Misc WARNING: SUS Client is rebooting
system.
2008-11-14 16:42:52:281 928 7c8 AU AU invoking RebootSystem (OnRebootRetry)
2008-11-14 16:42:52:281 928 7c8 AU AU rebooting machine since no user is
logged on and reboot is required.
2008-11-14 16:42:58:890 928 7c8 AU ########### AU: Uninitializing
Automatic Updates ###########
2008-11-14 16:42:59:546 928 7c8 Service ** END ** Service: Service exit
[Exit code = 0x240001]

[Thee Chicago Wolf]

>I have serveral Win2003 SP2 (64 bits, std, enterprise, everything) and all
>of then are rebooting without anyone using it. They´re very stable and it
>happens after some days with a WSUS Patch installed but without a reboot
>(reboot pending). Nobody is choosing "reboot" and if a RDP connection is
>made, the "reboot later" choice is always choosed and at the tima of the
>reboos, nobody was using the Servers
>
>The Error in the Event Viewer:
>
>Event Type: Information
>Event Source: USER32
>Event Category: None
>Event ID: 1074
>Date: 11/14/2008
>Time: 4:42:52 PM
>User: NT AUTHORITY\SYSTEM
>Computer: HDS-SRV-04
>Description:
>The process winlogon.exe has initiated the restart of computer HDS-SRV-04 on
>behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for
>this reason could be found
> Reason Code: 0x80020002
> Shutdown Type: restart
> Comment:
>
>For more information, see Help and Support Center at
>http://go.microsoft.com/fwlink/events.asp.
>Data:
>0000: 02 00 02 80 ...?
>
>The WSUS log:
>
>2008-11-14 16:42:52:156 928 7c8 AU WARNING: Initiating reboot since no user
>logged on
>2008-11-14 16:42:52:156 928 7c8 AU AU invoking RebootSystem (OnRebootNow)
>2008-11-14 16:42:52:281 928 7c8 Misc WARNING: SUS Client is rebooting
>system.
>2008-11-14 16:42:52:281 928 7c8 AU AU invoking RebootSystem (OnRebootRetry)
>2008-11-14 16:42:52:281 928 7c8 AU AU rebooting machine since no user is
>logged on and reboot is required.
>2008-11-14 16:42:58:890 928 7c8 AU ########### AU: Uninitializing
>Automatic Updates ###########
>2008-11-14 16:42:59:546 928 7c8 Service ** END ** Service: Service exit
>[Exit code = 0x240001]

That does not seem normal. Are you sure no backdooring happened here
or someone got access to your machine? Have you done a malware check
with Spybot to make sure the system is clean?

- Thee Chicago Wolf

[Dave Patrick]

These may help.

http://support.microsoft.com/default...b;en-us;911185
http://support.microsoft.com/default...b;en-us;818080


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


"KayZer sOZE" wrote:
>I have serveral Win2003 SP2 (64 bits, std, enterprise, everything) and all
>of then are rebooting without anyone using it. They´re very stable and it
>happens after some days with a WSUS Patch installed but without a reboot
>(reboot pending). Nobody is choosing "reboot" and if a RDP connection is
>made, the "reboot later" choice is always choosed and at the tima of the
>reboos, nobody was using the Servers
>
>
> The Error in the Event Viewer:
>
>
> Event Type: Information
> Event Source: USER32
> Event Category: None
> Event ID: 1074
> Date: 11/14/2008
> Time: 4:42:52 PM
> User: NT AUTHORITY\SYSTEM
> Computer: HDS-SRV-04
> Description:
> The process winlogon.exe has initiated the restart of computer HDS-SRV-04
> on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title
> for this reason could be found
> Reason Code: 0x80020002
> Shutdown Type: restart
> Comment:
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 02 00 02 80 ...?
>
>
>
>
> The WSUS log:
>
> 2008-11-14 16:42:52:156 928 7c8 AU WARNING: Initiating reboot since no
> user logged on
> 2008-11-14 16:42:52:156 928 7c8 AU AU invoking RebootSystem (OnRebootNow)
> 2008-11-14 16:42:52:281 928 7c8 Misc WARNING: SUS Client is rebooting
> system.
> 2008-11-14 16:42:52:281 928 7c8 AU AU invoking RebootSystem
> (OnRebootRetry)
> 2008-11-14 16:42:52:281 928 7c8 AU AU rebooting machine since no user is
> logged on and reboot is required.
> 2008-11-14 16:42:58:890 928 7c8 AU ########### AU: Uninitializing
> Automatic Updates ###########
> 2008-11-14 16:42:59:546 928 7c8 Service ** END ** Service: Service
> exit [Exit code = 0x240001]
>
>
>
>
>
>
>

[KayZer sOZE]

Here we have TREND AV, 100% updated


"Thee Chicago Wolf" <.@.> escreveu na mensagem
news:57prh49t1vapgi0hki9f60sm5102spqs73@4ax.com...
> >I have serveral Win2003 SP2 (64 bits, std, enterprise, everything) and
> >all
>>of then are rebooting without anyone using it. They´re very stable and it
>>happens after some days with a WSUS Patch installed but without a reboot
>>(reboot pending). Nobody is choosing "reboot" and if a RDP connection is
>>made, the "reboot later" choice is always choosed and at the tima of the
>>reboos, nobody was using the Servers
>>
>>The Error in the Event Viewer:
>>
>>Event Type: Information
>>Event Source: USER32
>>Event Category: None
>>Event ID: 1074
>>Date: 11/14/2008
>>Time: 4:42:52 PM
>>User: NT AUTHORITY\SYSTEM
>>Computer: HDS-SRV-04
>>Description:
>>The process winlogon.exe has initiated the restart of computer HDS-SRV-04
>>on
>>behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for
>>this reason could be found
>> Reason Code: 0x80020002
>> Shutdown Type: restart
>> Comment:
>>
>>For more information, see Help and Support Center at
>>http://go.microsoft.com/fwlink/events.asp.
>>Data:
>>0000: 02 00 02 80 ...?
>>
>>The WSUS log:
>>
>>2008-11-14 16:42:52:156 928 7c8 AU WARNING: Initiating reboot since no
>>user
>>logged on
>>2008-11-14 16:42:52:156 928 7c8 AU AU invoking RebootSystem (OnRebootNow)
>>2008-11-14 16:42:52:281 928 7c8 Misc WARNING: SUS Client is rebooting
>>system.
>>2008-11-14 16:42:52:281 928 7c8 AU AU invoking RebootSystem
>>(OnRebootRetry)
>>2008-11-14 16:42:52:281 928 7c8 AU AU rebooting machine since no user is
>>logged on and reboot is required.
>>2008-11-14 16:42:58:890 928 7c8 AU ########### AU: Uninitializing
>>Automatic Updates ###########
>>2008-11-14 16:42:59:546 928 7c8 Service ** END ** Service: Service
>>exit
>>[Exit code = 0x240001]
>
> That does not seem normal. Are you sure no backdooring happened here
> or someone got access to your machine? Have you done a malware check
> with Spybot to make sure the system is clean?
>
> - Thee Chicago Wolf

[Thee Chicago Wolf]

>Here we have TREND AV, 100% updated

For kicks, install and run Spybot.

- Thee Chicago Wolf