SBS server reboots regular as clockwork for no reason

Question

One of our clients who are still working in the dark ages has an SBS 2011 standard which has ( for the last couple of weeks) rebooted at exactly the same time every morning. Shuts down at 3:09 and reboots and is back on line 3 minutes later

Checked the event log and get the following - The kernel power manager has initiated a shutdown transition. event ID 109

• System
• Provider [ Name] Microsoft-Windows-Kernel-Power
  [ Guid] {331C3B3A-2005-44C2-AC5E-77220C37D6B4} EventID 109 Version 0 Level 4 Task 103 Opcode 0 Keywords 0x8000000000000004
• TimeCreated [ SystemTime] 2020-07-31T02:09:54.271625000Z EventRecordID 7434463 Correlation
• Execution [ ProcessID] 800
  [ ThreadID] 804 Channel System Computer ******************** Security
  • EventData
  ShutdownActionType 5
  ShutdownEventCode 0
  ShutdownReason 0

Thought it might have been a scheduled task that someone had inadvertantly created; but (to the best of my knowledge) I checked all of them and there is nothing that matches the reboot timing in the scheduled tasks

Any help would be appreciated

Terry M

Answer 1

Hi,

Above log only shows one planned restart on 02:02:20. Since there is no log created for the restart on 3:09, you need to collect logs using process monitor for further investigation.

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

You could run process monitor before the reboot and ensure that you enable boot loggin. And after the reboot on 3:09, you could then save the log and check what happened around 3:09 from the log.

Please also ensure that your disk has enough space to cache the log.

Thanks,
Eleven

Answer 2

I'll get that running before I leave the office today and will see what it says Monday