The process wininit.exe (127.0.0.1) has initiated the restart of computer

Question

One of my servers automatically restarts every day since activation, and I found that the following event is logged。

The process wininit.exe (127.0.0.1) has initiated the restart of computer ZTZN on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown

Reason Code: 0x80070000

Shutdown Type: restart

Answer 1

I have found the problem, wininit.exe is a very important file for Windows, it is a 100% safe file. I found out through the logs that my Windows Server 2016 malware infection was disguised as a genuine wininit .exe, causing the device to keep restarting.

To determine if wininit.exe is genuine, you must check these features.

• WinInit .exe Digital Signature – It must come with Microsoft's digital signature and certificate, which you can view from the properties of this exe file

• Where wininit.exe runs – it must run from the location specified above, and you can check it from the task manager that shows the running processes
• The file size of wininit.exe - it cannot be significantly higher than the specified size (i.e. 409 KB), you can check it from the properties of this exe file If your system is restarting or shutting down the wininit .exe, then you can fix it by following these methods

To do this, you must increase the MaxTempTableSize value so that the system does not restart or shut down.

MaxTempTableSize here is basically a value mentioned in Microsoft Active Directory, which mentions how large a temporary database table can be processed at one time.

Therefore, now we must increase MaxTempTableSize on LDAP to 100000 so that the system can handle the database load. More details are available here: [View and set Lightweight Directory Access Protocol (LDAP) policies with Ntdsutil - Windows ServerMicrosoft](https://(https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/view-set-ldap-policy-using-ntdsutil)

Here are the steps to change policy settings:

1. Open an Ntdsutil.exe command prompt, type LDAP policy, and press the Enter button
2. Now, enter the following command Set MaxTempTableSize to 100000
3. Now click the Enter button

Restart the system when finished.