Printable View
Ok, someone I know has a Win 2k server that he likes to leave logged in at all times as admin, but for some reason it seems to be logging it’s self out (I know this is a good thing, but it’s not the way he wants it). The last time I looked at the logs not much was logged, so I changed the policy to log more information. What all things should I look for that may be causing a logout or reboot?
How about firing up ProcessExplorer or something like it to see if there is a rogue process running? I'd be checking what the last processes that occur before the logout/reboot? (is it a reboot or a log out?)
I'm not sure yet, by default Win 2k does not seem to log all the info I need. I've since changed the audit policy and now it should log more system info.
There is a local policy option to that can be enabled to logout an account after a period of time if there is no activity.
I can't remember exactly where it is but you should be able to search around the policy options for it.
A long shot but is autoupdates configured? It could be rebooting itself after updating.
IIRC there used to be a logout.scr (screensaver) in the resource kit.
Reboots would show up in the system eventlog as Eventlog service stopped; ID 6006, (system started) ID 6009 and Eventlog service started; ID 6005.
Hmmmm,
Is this happening frequently and at regular intervals or does it appear to be random?
I would check the fans and ventilation.
I would also turn off all power saving options and the screensaver, if applicable.
Also turn of the restart on error options so we can see if it is a crash or a reboot. It might even display a message.
I am not sure if it is in Win 2000 Server, but if he has drwatson.exe he could try running it, as it may give information not in his system logs?
:)
Thanks. I checked the power options the last time I was there and it does not seem to be that, and as I recall no screen saver was enabled. I hope to find something in the even log when I look tonight.
I would really check the domain options to see if the forced log off is activated. You could also leave the admin account active on an other machine to see if it is the machine or the account.
Also if he is using the server as a supervision station you can get some strange behavoir with things like compaq insight manager and other network supervision tools especially if you have more than one running on the server.
Another thing that maybe happening is if he running scripts on the machine to collect data one of his scripts might be causing the logoff.
Anyway best of luck and if you still find nothing try Technet :D
This might help
I did some more looking into it, looks like it was a restart instead of a log off. Right now, it looks like the UPS is to blame.
unexpected restarts....or power loss???
Or the ups trys to shutdown due to loss of power and a service hangs...delaying the shutdown and then server loses power before shutdown is complete....???
MLF
Just straight out power loss.