locked
event ID 1074 server restarts RRS feed

  • Question

  • I am getting the following error on a few of my servers;

    Server 2008 R2 Standard 64-bit

    Event ID 1074

    Source USER32

    User SYSTEM

    The process C:\Windows\SysWOW64\shutdown.exe (SERVER) has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found

    Reason Code: 0x800000ff

    Shutdown Type: restart

    Comment:

    This just recently started to happen. No one is logged onto the server when it happens. Any thoughts?

    Tuesday, May 13, 2014 9:34 PM

Answers

  • Hi,

    In Windows Server 2008 R2, by default we have the facility of logging (1074) the restart and shutdown events. The Shutdown Event Tracker enables logs to provide a reason for any system shutdown or restart event. The 1074 event is generated for both user or application initiated restarts or shutdowns. So you need to confirm any application or scripts are running at the backend. 

    Checkout the below article on Shutdown Event Tracker, Types of Shutdown and How to disable the logs,
    How to disable the Shutdown Event Tracker in Windows Server 2008 R2

    Regards,
    Gopi
    JiJi Technologies

    Wednesday, May 14, 2014 6:39 AM