Reboot of server by winlogon ?????

[Franc v/d Westelaken]

Hello,

this morning our server rebooted without notice. In the eventlog I've
found the following entry:

The process winlogon.exe has initiated the restart of computer
<computername> on behalf of user NT AUTHORITY\SYSTEM for the following
reason: No title for this reason could be found
Reason Code: 0x80020002
Shutdown Type: restart
Comment:

Why is winlogon rebooting our server ?

It's a windows 2003 R2 server.

Franc.

[Lennaert]

I've had this some days ago... here it was because winlogon was ended by
a user...

Lennaert

Franc v/d Westelaken wrote:
> Hello,
>
> this morning our server rebooted without notice. In the eventlog I've
> found the following entry:
>
> The process winlogon.exe has initiated the restart of computer
> <computername> on behalf of user NT AUTHORITY\SYSTEM for the following
> reason: No title for this reason could be found
> Reason Code: 0x80020002
> Shutdown Type: restart
> Comment:
>
> Why is winlogon rebooting our server ?
>
> It's a windows 2003 R2 server.
>
> Franc.

[Franc v/d Westelaken]

Hi,

well in this case no one did. It's our test exchange server... Could
it be that winlogon crashed for some reason and then it initiates a
system reboot ?

Franc.

Lennaert <lennaert_bosch@hotmail.com> wrote:

>I've had this some days ago... here it was because winlogon was ended by
>a user...
>
>Lennaert
>
>Franc v/d Westelaken wrote:
>> Hello,
>>
>> this morning our server rebooted without notice. In the eventlog I've
>> found the following entry:
>>
>> The process winlogon.exe has initiated the restart of computer
>> <computername> on behalf of user NT AUTHORITY\SYSTEM for the following
>> reason: No title for this reason could be found
>> Reason Code: 0x80020002
>> Shutdown Type: restart
>> Comment:
>>
>> Why is winlogon rebooting our server ?
>>
>> It's a windows 2003 R2 server.
>>
>> Franc.

[Lennaert]

yes that's possible...


Lennaert

Franc v/d Westelaken wrote:
> Hi,
>
> well in this case no one did. It's our test exchange server... Could
> it be that winlogon crashed for some reason and then it initiates a
> system reboot ?
>
> Franc.
>
> Lennaert <lennaert_bosch@hotmail.com> wrote:
>
>> I've had this some days ago... here it was because winlogon was ended by
>> a user...
>>
>> Lennaert
>>
>> Franc v/d Westelaken wrote:
>>> Hello,
>>>
>>> this morning our server rebooted without notice. In the eventlog I've
>>> found the following entry:
>>>
>>> The process winlogon.exe has initiated the restart of computer
>>> <computername> on behalf of user NT AUTHORITY\SYSTEM for the following
>>> reason: No title for this reason could be found
>>> Reason Code: 0x80020002
>>> Shutdown Type: restart
>>> Comment:
>>>
>>> Why is winlogon rebooting our server ?
>>>
>>> It's a windows 2003 R2 server.
>>>
>>> Franc.
>

Check your system for malware and make sure it's fully patched.


"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
news:vgpj02h6tfm9vqk2i3hmaccbft9jfdb1jq@4ax.com...
> Hi,
>
> well in this case no one did. It's our test exchange server... Could
> it be that winlogon crashed for some reason and then it initiates a
> system reboot ?
>
> Franc.
>
> Lennaert <lennaert_bosch@hotmail.com> wrote:
>
>>I've had this some days ago... here it was because winlogon was ended by
>>a user...
>>
>>Lennaert
>>
>>Franc v/d Westelaken wrote:
>>> Hello,
>>>
>>> this morning our server rebooted without notice. In the eventlog I've
>>> found the following entry:
>>>
>>> The process winlogon.exe has initiated the restart of computer
>>> <computername> on behalf of user NT AUTHORITY\SYSTEM for the following
>>> reason: No title for this reason could be found
>>> Reason Code: 0x80020002
>>> Shutdown Type: restart
>>> Comment:
>>>
>>> Why is winlogon rebooting our server ?
>>>
>>> It's a windows 2003 R2 server.
>>>
>>> Franc.
>

Question, running Acronis on the server?

"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
news:vgpj02h6tfm9vqk2i3hmaccbft9jfdb1jq@4ax.com...
> Hi,
>
> well in this case no one did. It's our test exchange server... Could
> it be that winlogon crashed for some reason and then it initiates a
> system reboot ?
>
> Franc.
>
> Lennaert <lennaert_bosch@hotmail.com> wrote:
>
>>I've had this some days ago... here it was because winlogon was ended by
>>a user...
>>
>>Lennaert
>>
>>Franc v/d Westelaken wrote:
>>> Hello,
>>>
>>> this morning our server rebooted without notice. In the eventlog I've
>>> found the following entry:
>>>
>>> The process winlogon.exe has initiated the restart of computer
>>> <computername> on behalf of user NT AUTHORITY\SYSTEM for the following
>>> reason: No title for this reason could be found
>>> Reason Code: 0x80020002
>>> Shutdown Type: restart
>>> Comment:
>>>
>>> Why is winlogon rebooting our server ?
>>>
>>> It's a windows 2003 R2 server.
>>>
>>> Franc.
>

[Franc v/d Westelaken]

Hi,

no not running acronis... System is fully patched and clean..
Yesterday it was the first time the issue occurred and hasn't occurred
yet again..

Franc.

<workinghard@news.postalias> wrote:

>Question, running Acronis on the server?
>
>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>news:vgpj02h6tfm9vqk2i3hmaccbft9jfdb1jq@4ax.com...
>> Hi,
>>
>> well in this case no one did. It's our test exchange server... Could
>> it be that winlogon crashed for some reason and then it initiates a
>> system reboot ?
>>
>> Franc.
>>
>> Lennaert <lennaert_bosch@hotmail.com> wrote:
>>
>>>I've had this some days ago... here it was because winlogon was ended by
>>>a user...
>>>
>>>Lennaert
>>>
>>>Franc v/d Westelaken wrote:
>>>> Hello,
>>>>
>>>> this morning our server rebooted without notice. In the eventlog I've
>>>> found the following entry:
>>>>
>>>> The process winlogon.exe has initiated the restart of computer
>>>> <computername> on behalf of user NT AUTHORITY\SYSTEM for the following
>>>> reason: No title for this reason could be found
>>>> Reason Code: 0x80020002
>>>> Shutdown Type: restart
>>>> Comment:
>>>>
>>>> Why is winlogon rebooting our server ?
>>>>
>>>> It's a windows 2003 R2 server.
>>>>
>>>> Franc.
>>
>

WSUS runing or Windows update, any auto installation of patchs scheduled?

"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
news:2bgl02hanp389fpkrvh31fkru89l8pttci@4ax.com...
> Hi,
>
> no not running acronis... System is fully patched and clean..
> Yesterday it was the first time the issue occurred and hasn't occurred
> yet again..
>
> Franc.
>
> <workinghard@news.postalias> wrote:
>
>>Question, running Acronis on the server?
>>
>>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>>news:vgpj02h6tfm9vqk2i3hmaccbft9jfdb1jq@4ax.com...
>>> Hi,
>>>
>>> well in this case no one did. It's our test exchange server... Could
>>> it be that winlogon crashed for some reason and then it initiates a
>>> system reboot ?
>>>
>>> Franc.
>>>
>>> Lennaert <lennaert_bosch@hotmail.com> wrote:
>>>
>>>>I've had this some days ago... here it was because winlogon was ended by
>>>>a user...
>>>>
>>>>Lennaert
>>>>
>>>>Franc v/d Westelaken wrote:
>>>>> Hello,
>>>>>
>>>>> this morning our server rebooted without notice. In the eventlog I've
>>>>> found the following entry:
>>>>>
>>>>> The process winlogon.exe has initiated the restart of computer
>>>>> <computername> on behalf of user NT AUTHORITY\SYSTEM for the following
>>>>> reason: No title for this reason could be found
>>>>> Reason Code: 0x80020002
>>>>> Shutdown Type: restart
>>>>> Comment:
>>>>>
>>>>> Why is winlogon rebooting our server ?
>>>>>
>>>>> It's a windows 2003 R2 server.
>>>>>
>>>>> Franc.
>>>
>>
>

[Franc v/d Westelaken]

Automatic updates is enabled and configured that it is allowed to
install updates automatically which don't require a reboot.

Franc.

Hold on ... "which don't require a reboot" ... with autoupdates how do you
determine this ... the only thing you can do is postpone update ...

"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
news:bvbm02tociieco9jgqjhl0flclig06itnh@4ax.com...
> Automatic updates is enabled and configured that it is allowed to
> install updates automatically which don't require a reboot.
>
> Franc.

[Franc v/d Westelaken]

Nope, there a registry setting and a GPO which allows you to
automatically install updates whcih don't require a reboot.

this one:

Specifies whether Automatic Updates should automatically install
certain updates that neither interrupt Windows services nor restart
Windows.

If the status is set to Enabled, Automatic Updates will immediately
install these updates once they are downloaded and ready to install.

If the status is set to Disabled, such updates will not be installed
immediately.

Note: If the "Configure Automatic Updates" policy is disabled, this
policy has no effect.

Franc.

<workinghard@news.postalias> wrote:

>Hold on ... "which don't require a reboot" ... with autoupdates how do you
>determine this ... the only thing you can do is postpone update ...
>
>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>news:bvbm02tociieco9jgqjhl0flclig06itnh@4ax.com...
>> Automatic updates is enabled and configured that it is allowed to
>> install updates automatically which don't require a reboot.
>>
>> Franc.
>

OK , your using WSUS, not Windows Update ...

To date I have not yet seen an update in that category ... but i could be
wrong.

What are the otherx settings for WSUS in the GPO, have a look at the WSUS
log on the machine to see it something happend around the time of the reboot


"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
news:svgm02du9u8tlbtgkqo82rruj3884o2crp@4ax.com...
> Nope, there a registry setting and a GPO which allows you to
> automatically install updates whcih don't require a reboot.
>
> this one:
>
> Specifies whether Automatic Updates should automatically install
> certain updates that neither interrupt Windows services nor restart
> Windows.
>
> If the status is set to Enabled, Automatic Updates will immediately
> install these updates once they are downloaded and ready to install.
>
> If the status is set to Disabled, such updates will not be installed
> immediately.
>
> Note: If the "Configure Automatic Updates" policy is disabled, this
> policy has no effect.
>
> Franc.
>
> <workinghard@news.postalias> wrote:
>
>>Hold on ... "which don't require a reboot" ... with autoupdates how do you
>>determine this ... the only thing you can do is postpone update ...
>>
>>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>>news:bvbm02tociieco9jgqjhl0flclig06itnh@4ax.com...
>>> Automatic updates is enabled and configured that it is allowed to
>>> install updates automatically which don't require a reboot.
>>>
>>> Franc.
>>
>

[Franc v/d Westelaken]

Already did that, no WSUS activity around that time. Server has been
stable all day now, so I gues it was a one time occasion (let's hope
so).

Franc.

<workinghard@news.postalias> wrote:

>OK , your using WSUS, not Windows Update ...
>
>To date I have not yet seen an update in that category ... but i could be
>wrong.
>
>What are the otherx settings for WSUS in the GPO, have a look at the WSUS
>log on the machine to see it something happend around the time of the reboot
>
>
>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>news:svgm02du9u8tlbtgkqo82rruj3884o2crp@4ax.com...
>> Nope, there a registry setting and a GPO which allows you to
>> automatically install updates whcih don't require a reboot.
>>
>> this one:
>>
>> Specifies whether Automatic Updates should automatically install
>> certain updates that neither interrupt Windows services nor restart
>> Windows.
>>
>> If the status is set to Enabled, Automatic Updates will immediately
>> install these updates once they are downloaded and ready to install.
>>
>> If the status is set to Disabled, such updates will not be installed
>> immediately.
>>
>> Note: If the "Configure Automatic Updates" policy is disabled, this
>> policy has no effect.
>>
>> Franc.
>>
>> <workinghard@news.postalias> wrote:
>>
>>>Hold on ... "which don't require a reboot" ... with autoupdates how do you
>>>determine this ... the only thing you can do is postpone update ...
>>>
>>>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>>>news:bvbm02tociieco9jgqjhl0flclig06itnh@4ax.com...
>>>> Automatic updates is enabled and configured that it is allowed to
>>>> install updates automatically which don't require a reboot.
>>>>
>>>> Franc.
>>>
>>
>

OK, mysterious ...

Reason Code: 0x80020002

smells of an update by WSUS ... when did you last time patch ... did it
reboot then was that postponed for some reason ...


"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
news:bglm02d984bk5duq8fnh2ucqpvpv5aeg9a@4ax.com...
> Already did that, no WSUS activity around that time. Server has been
> stable all day now, so I gues it was a one time occasion (let's hope
> so).
>
> Franc.
>
> <workinghard@news.postalias> wrote:
>
>>OK , your using WSUS, not Windows Update ...
>>
>>To date I have not yet seen an update in that category ... but i could be
>>wrong.
>>
>>What are the otherx settings for WSUS in the GPO, have a look at the WSUS
>>log on the machine to see it something happend around the time of the
>>reboot
>>
>>
>>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>>news:svgm02du9u8tlbtgkqo82rruj3884o2crp@4ax.com...
>>> Nope, there a registry setting and a GPO which allows you to
>>> automatically install updates whcih don't require a reboot.
>>>
>>> this one:
>>>
>>> Specifies whether Automatic Updates should automatically install
>>> certain updates that neither interrupt Windows services nor restart
>>> Windows.
>>>
>>> If the status is set to Enabled, Automatic Updates will immediately
>>> install these updates once they are downloaded and ready to install.
>>>
>>> If the status is set to Disabled, such updates will not be installed
>>> immediately.
>>>
>>> Note: If the "Configure Automatic Updates" policy is disabled, this
>>> policy has no effect.
>>>
>>> Franc.
>>>
>>> <workinghard@news.postalias> wrote:
>>>
>>>>Hold on ... "which don't require a reboot" ... with autoupdates how do
>>>>you
>>>>determine this ... the only thing you can do is postpone update ...
>>>>
>>>>"Franc v/d Westelaken" <FvdWestelaken@hotmail.com> wrote in message
>>>>news:bvbm02tociieco9jgqjhl0flclig06itnh@4ax.com...
>>>>> Automatic updates is enabled and configured that it is allowed to
>>>>> install updates automatically which don't require a reboot.
>>>>>
>>>>> Franc.
>>>>
>>>
>>
>