|
it
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
shutdown unknowingly!
account is responsible for that. There was a clean shutdown of the system at specific time (event IDs 6005 and 6006 suggest this; also, there is no event ID 6008 which would indicate a "dirty" shutdown). The user logoff event (event ID 538) immediately preceding the system shutdown event, is not matching with any of the user logon events (event ID 528). Kindly advice is there any other way we can find the culprit (in windows 2000 server). Thanks, Raman If no BSOD's occur (Event ID: 1001 Source: Save Dump), then it may be a
power problem. I would look at a possible faulty (or undersized) pc power supply, UPS, bad battery, or the circuit feeding the outlet that the pc is plugged into. Also check the cmos setup power settings. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect Show quote "Raman" wrote: > One of our server has been shutdown unknowingly, I was investigating, > which account is responsible for that. > > > > There was a clean shutdown of the system at specific time (event IDs 6005 > and 6006 suggest this; also, there is no event ID 6008 which would > indicate a "dirty" shutdown). The user logoff event (event ID 538) > immediately preceding the system shutdown event, is not matching with any > of the user logon events (event ID 528). > > > > Kindly advice is there any other way we can find the culprit (in windows > 2000 server). > > > > Thanks, > > > > Raman > > As I've mentioned early, No BSOD /No Memory.dmp, it's a clean shutdown of
the system at specific time. Here I'm trying to find who has logged in to the server during that time. Thanks, -Raman Show quote "Dave Patrick" <DSPatrick@nospam.gmail.com> wrote in message news:640D1C52-0CA2-4394-BE09-15921C518E56@microsoft.com... > If no BSOD's occur (Event ID: 1001 Source: Save Dump), then it may be a > power problem. I would look at a possible faulty (or undersized) pc power > supply, UPS, bad battery, or the circuit feeding the outlet that the pc is > plugged into. > > Also check the cmos setup power settings. > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "Raman" wrote: >> One of our server has been shutdown unknowingly, I was investigating, >> which account is responsible for that. >> >> >> >> There was a clean shutdown of the system at specific time (event IDs 6005 >> and 6006 suggest this; also, there is no event ID 6008 which would >> indicate a "dirty" shutdown). The user logoff event (event ID 538) >> immediately preceding the system shutdown event, is not matching with any >> of the user logon events (event ID 528). >> >> >> >> Kindly advice is there any other way we can find the culprit (in windows >> 2000 server). >> >> >> >> Thanks, >> >> >> >> Raman >> >> >  |
|||||||||||||||||||||||
Other interesting topics