none
Hyper-V VM crashing with Kernel-Power Critical logs in Event Viewer

    Pergunta

  • I am stumped here.

    We have a Windows Server 2016 Datacenter Host, Hyper-V role, 8 Virtual Machines (all same OS as host).

    One of these Virtual Machines is a Terminal Server for a number of users inside and outside the LAN. I'll call it TS-SERVER. TS-SERVER randomly reboots a number of times a week. It always logs Event 41, Kernel-Power, but I cannot find the underlying reason. Obviously this is a critical issue for us since 5-10 users can be logged into this VM at any given time, all of them losing any unsaved work every time it happens. 

    I've browsed the event logs surrounding the times of the reboots, but I can't seem to pinpoint any related events.  No Bugcheck logged either. 

    Any suggestions are appreciated. Thank you


    Log Name:      System
    Source:        Microsoft-Windows-Kernel-Power
    Date:          2/27/2018 11:05:20 AM
    Event ID:      41
    Task Category: (63)
    Level:         Critical
    Keywords:      (70368744177664),(2)
    User:          SYSTEM
    Computer:      TS-SERVER.domain.local
    Description:
    The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
        <EventID>41</EventID>
        <Version>4</Version>
        <Level>1</Level>
        <Task>63</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000400000000002</Keywords>
        <TimeCreated SystemTime="2018-02-27T19:05:20.244601800Z" />
        <EventRecordID>42356</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="8" />
        <Channel>System</Channel>
        <Computer>TS-SERVER.domain.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="BugcheckCode">0</Data>
        <Data Name="BugcheckParameter1">0x0</Data>
        <Data Name="BugcheckParameter2">0x0</Data>
        <Data Name="BugcheckParameter3">0x0</Data>
        <Data Name="BugcheckParameter4">0x0</Data>
        <Data Name="SleepInProgress">0</Data>
        <Data Name="PowerButtonTimestamp">0</Data>
        <Data Name="BootAppStatus">0</Data>
        <Data Name="Checkpoint">0</Data>
        <Data Name="ConnectedStandbyInProgress">false</Data>
        <Data Name="SystemSleepTransitionsToOn">0</Data>
        <Data Name="CsEntryScenarioInstanceId">0</Data>
      </EventData>
    </Event>
    • Editado mattwc terça-feira, 27 de fevereiro de 2018 20:02
    terça-feira, 27 de fevereiro de 2018 19:48

Todas as Respostas

  • I'd try; under system properties, Advanced system settings, Advanced tab, Startup and Recovery section, Settings, clear the Automatically restart check box.

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    terça-feira, 27 de fevereiro de 2018 22:28
  • Thanks Dave, did that just now. Now it's a waiting game because it really is random. Sometimes it happens once a week, sometimes twice in 24 hours. 

    quarta-feira, 28 de fevereiro de 2018 16:53
  • Sounds good, see what happens.

     

     



    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    quarta-feira, 28 de fevereiro de 2018 16:56
  • Looks like it happened again on Sunday, same Kernel-Power error. I didn't notice until now since no one was affected by it on a Sunday. The last time it happened before that was 2/27, the day I posted this thread. 
    terça-feira, 6 de março de 2018 18:16
  • Are there any Group Policy settings applied that have to do with power?

    Are there any power related issues on the host?

    Are the host and guests up to date?


    Philip Elder Microsoft High Availability MVP Blog: http://blog.mpecsinc.ca Twitter: @MPECSInc

    quarta-feira, 7 de março de 2018 06:01
  • Hi ,

    Just want to confirm the current situations.

    Please feel free to let us know if you need further assistance.

    Best Regards,
    Candy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    quinta-feira, 8 de março de 2018 05:40
  • Has anyone heard of a fix or more information on this. I'm having the exact same issue on two HyperV VM's in the same situation, they host our thin client sessions so when they die the users booted out in the middle of what they were doing. This started happening 2-3 days ago and I've ran Windows update and rebooted when necessary both the VM hosts and the VM's. There are about 14 VM's between the two hosts and only these two VM's are being affected.
    sexta-feira, 16 de março de 2018 16:57
  • Sorry everyone, I stopped getting email notifications on this thread for some reason. 

    Phillip,

    No GPOs related to power, no power issues on host, and all is relatively up to date. The host was last updated about a month ago, the VM is updated once a week or so. 

    I haven't seen a Kernel Failure in 10 days, and the only thing I changed was the NAT policy in our firewall. I was noticing a huge amount of failed login attempts every second because we were using the default RDP port number 3389 and it was open to the public. I thought this would be fine since we have 2-factor authentication using third party software, but seeing all the attempts in the event log made me uncomfortable so I changed the NAT policy only for outside sources. This is literally all I changed, and I haven't seen a power failure since (or any questionable logon attempts). I don't know if it's coincidence or if somehow the brute force attempts were triggering something that caused the unexpected shutdown. If it happens again, I'll post here right away, but for now that's the only clue I have as to a related event or possible cause.

    segunda-feira, 19 de março de 2018 19:34
  • TSGrinder.

    Please use RD Gateway and RD Broker with a separate RD Session Host. 

    Never, _ever_, open a Remote Desktop Protocol listener to the Internet on any port.


    Philip Elder Microsoft High Availability MVP Blog: http://blog.mpecsinc.ca Twitter: @MPECSInc


    segunda-feira, 19 de março de 2018 19:38
  • The problem is back... it was down to only happening once a month or so. Now it's had 3 kernel-power reboots in the last two days. There have been no changes that we're aware of, and event viewer doesn't tell me anything except "the previous system shutdown ... was unexpected"

    quarta-feira, 16 de maio de 2018 18:41
  • Did you ever find a solution?
    quarta-feira, 16 de maio de 2018 18:42
  • The night before the problem came back I had upped the number of virtual cores from 8 to 12. After 4 reboots in two days I put it back down to 8 and today it has been fine so far
    quinta-feira, 17 de maio de 2018 22:37