All PCs mysteriously restarted in our environment...

[XRJoe]

Yesterday at 2:20pm about 90% of our PCs (along with several servers) mysteriously restarted with no messages or errors and nothing listed in Even Viewer. I know this is a shot in the dark but has anyone else ever experienced something like this?

A little about our environment:
- Over 4,000 PCs w/ Several hundred servers. Mostly Windows environment.
- Large Citrix Farm (presentation server 3.0)
- Most clients managed with Altiris
- Cisco network componants

Any suggestions would be appreciated. Thanks!

 

[Roadki11]

Power hickup? Ive seen that happen when the power flickers, almost unnoticable to the human eye and just enough to cause almost anything not on a UPS to reboot.

 

[XRJoe]

Good guess although I don't think that was the case. This happened across several remote facilities around the state at the same time.

I should clarify, to those this affected, they described it as if they Shut down the PC. Applications closed (some prompting to save information) and then the system just reboot. Other than some warnings and errors regarding NTP (has been a small issue with this for a couple weeks I guess), there is nothing listed in any of the Even Viewer logs.

 

[pgaliardo]

Are any of the servers Windows 2003? If so, if you look at the Event Logs,it usually gives a pretty good hint as to what initiated the shutdown of a server.

 

[XRJoe]

Yes there was, below is an entry in the event viewer log:

Date: 08/22/07 Source: User32
Time: 2:20:41PM Category: None
Type Information EventID: 1074
User: NT AUTHORITY\SYSTEM
COMPUTER: <NAME>

The process winlogon.exe has initiated the restart of computer <NAME> on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80030004
Shutdown Type: restart
Comment:

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

 

[markdmac]

Looks to me like someone had some fun with a VBScript reboot script.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.