locked
Shutdown button restarts! RRS feed

  • Question

  • Hi All,

    I have a very strange issue with two users on my network. When a user logs on and selects Start then Shutdown it reboots the PC. If we log on as someone else this problem does not happen, it is only there user account causing the issue. 

    I have checked the event log and it seems when they hit the shutdown button it does request a shutdown, but then immediately after there is another event log ID asking for a reboot, please see below:

    Log Name:      System

    Source:        USER32

    Date:          31/10/2013 12:31:51

    Event ID:      1074

    Task Category: None

    Level:         Information

    Keywords:      Classic

    User:          XXX\XXX

    Computer:      XXX

    Description:

    The process C:\Windows\system32\winlogon.exe (XXX) has initiated the restart of computer XXX on behalf of user XXX\XXX for the following reason: No title for this reason could be found

    Reason Code: 0x500ff

    Shutdown Type: restart

    Comment:

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="USER32" />

        <EventID Qualifiers="32768">1074</EventID>

        <Level>4</Level>

        <Task>0</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-10-31T12:31:51.000000000Z" />

        <EventRecordID>8015</EventRecordID>

        <Channel>System</Channel>

        <Computer>SYN-W7L-01705.stl.local</Computer>

        <Security UserID="S-1-5-21-2691945375-2384309877-864831409-3143" />

      </System>

      <EventData>

        <Data>C:\Windows\system32\winlogon.exe (SYN-W7L-01705)</Data>

        <Data>XXX</Data>

        <Data>No title for this reason could be found</Data>

        <Data>0x500ff</Data>

        <Data>restart</Data>

        <Data>

        </Data>

        <Data>XXX\XXX</Data>

        <Binary>FF000500000000000000000000000000000000000000000000000000000000000000000000000000</Binary>

      </EventData>

    </Event>

    Log Name:      System

    Source:        USER32

    Date:          31/10/2013 12:31:46

    Event ID:      1074

    Task Category: None

    Level:         Information

    Keywords:      Classic

    User:          XXX\XXX

    Computer:      XXX

    Description:

    The process Explorer.EXE has initiated the power off of computer XXX on behalf of user XXX\XXX for the following reason: Other (Unplanned)

    Reason Code: 0x0

    Shutdown Type: power off

    Comment:

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="USER32" />

        <EventID Qualifiers="32768">1074</EventID>

        <Level>4</Level>

        <Task>0</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-10-31T12:31:46.000000000Z" />

        <EventRecordID>8014</EventRecordID>

        <Channel>System</Channel>

        <Computer>XXX</Computer>

        <Security UserID="S-1-5-21-2691945375-2384309877-864831409-3143" />

      </System>

      <EventData>

        <Data>Explorer.EXE</Data>

        <Data>SYN-W7L-01705</Data>

        <Data>Other (Unplanned)</Data>

        <Data>0x0</Data>

        <Data>power off</Data>

        <Data>

        </Data>

        <Data>XXX\XXX</Data>

        <Binary>00000000000000000000000000000000000000000000000000000000000000000000000000000000</Binary>

      </EventData>

    </Event>

    I would prefer not to re-create the profile as the machine was only rebuilt the other day. 

    Any help would be much appreciated.

    Thanks,

    Danny

    Friday, November 1, 2013 9:53 AM

All replies

  • Select Start --> Run and type regedit and press the Enter button.

    Locate the following key.

    Location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

    Edit the PowerdownAfterShutdown string value. Change the value from 0 to 1.

    Then restart the computer.

    Friday, November 1, 2013 10:15 AM
  • Hi,

    Thanks for the reply, I forgot to mention I have already tried this but it did not fix it :(

    Thanks,
    Danny

    Friday, November 1, 2013 10:16 AM
  • Have you tried to run the System File Checker tool?

    Command prompt > sfc /scannow

    Friday, November 1, 2013 11:06 AM
  • Hi,

    What did this user in the PC? Such as installing Direct CD program, etc.

    Also please uncheck “automatically restart” option.

    1. Select Start, type sysdm.cpl, and press ENTER.
    2. Click the Advanced tab, and then click the Settings button under 'Startup and Recovery'.
    3. Uncheck “automatically restart”.

    In my mind, when you shut down your PC, something may go wrong in this PC and crashes the computer. That is, the option masks the actual problem via restarting the computer.

    Thanks!


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

    • Marked as answer by 暁北 Wednesday, November 6, 2013 7:49 AM
    • Unmarked as answer by 暁北 Wednesday, November 6, 2013 3:37 PM
    Tuesday, November 5, 2013 3:19 PM
  • Hi,

    Thanks for all the replies, I have tried all of the above but it still reboots!

    Does anyone have any ideas on what I can do to fix this? 

    Thanks,

    Danny

    Wednesday, November 6, 2013 12:48 PM
  • If this is a domain joined PC/user, could this be a GPO applying to this user only, changing the power options?

    Have you compared the policies assigned to this user and one that this does not effect?

    Kind Regards

    Barry

    Thursday, November 7, 2013 8:43 AM
  • Hi Barry,

    I have checked the GPO and it seems to be exactly the same, is there a way of finding out what GPO's are currently being applied for that user?

    Thanks,

    Danny

    Thursday, November 7, 2013 10:36 AM
  • Run a command prompt as administrator and type "GPRESULT /R" to see what group policies are currently being applied.

    Ben


    • Edited by Ben Bell Thursday, November 7, 2013 11:26 AM
    Thursday, November 7, 2013 11:26 AM
  • The 'Group Policy Results Wizard' can also be run from the Group Policy Management console, which you can easily compare two results and even export them if needed.

    Kind Regards

    Barry

    Thursday, November 7, 2013 11:59 AM
  • HI

    try the following intructions to change the user's profile:

    -restart the PC

    -log on the computer with an domain admin or local admin account

    -rename c:\users\theUserProfileName into c:\users\OldtheUserProfileName.

    - clic on start

    - in the search program and files area, enter regedit.exe

    - right clic on regedit.exe and run it as administrator

    -browse to the key hklm\software\microsoft\windows NT\currentversion\ and extend the key called "ProfileList".

    - point or clic on each subkey under profilelist to locate which one contents in the right pane, the value "profileimapath" set with the username. then delete the subkey . notice that the subkey is directly under "profilelist" and written in the form S-1..... then close the registry editor

    - log off

    -now ask the concerned user to log on again on the PC.

    -it works, access the old user profile "c:\users\OldtheUserProfileName"  to copy back his data in the newly created profile c:\users\theUserProfileName  .

    regards

    Pat.

    Thursday, November 7, 2013 1:17 PM
  • Hi,

    I have checked the GP's and they are the same as a PC that does not have this issue. I have also created a new profile and it still wont shutdown! 

    Thanks,

    Danny

    Friday, November 8, 2013 10:42 AM
  • Just a hunch... it could be that as your maching is shutting down - it could be erroring on something and "Auto-Restarting" on a system failure.  I've only seen this once before with a corrupt driver - so give this a try and if it doesn't fix your issue - reverse it.

    Click Start > right click computer > Properties > "Advanced System Settings" > Startup and Recovery" Settings button (third one down).

    Untick all 3 boxes under "system Failure" (titled Write an Event Log, Automatically Restart and Overwrite any Existing File), and click ok > ok > ok... until you are back at your desktop.

    Reboot your PC for this to fully take efect and then after a restart, attempt a shutdown.

    If you are like me and are likely to forget which boxes were ticked/unticked to begin with, take a screenshot and save it so you have something to compare to when reverting.

    Let me know how this works out and we can rule a few things out or start pushing towards a good diagnosis.

    Friday, November 8, 2013 11:28 AM
  • Hi Ben,

    I have already tried this. I think it is down to that event log entry I posted above, as soon as I click shutdown you can see from the event log it is actually asking the system to restart. 

    Thanks,
    Danny

    Friday, November 8, 2013 11:29 AM
  • ok, my bad - I'll keep digging :)
    Friday, November 8, 2013 11:46 AM
  • Thanks! this has got the whole team in tatters! 
    Friday, November 8, 2013 12:13 PM