Task Scheduler went crazy

[AntonKouzoub]

Hi guys,

i got a slight problem with my 2003 server, a some point of time probably a year ago a scheduled task was created to reboot the server (they had some issues back then. i think it was hanging) using winlogon.exe , couple of month ago the task was deleted by the guy who created it. and now even though the task is not there it still reboots server right on schedule at 6AM... Task scheduler doesnt have any jobs scheduled, i checked it to view hidden task and its not there.

This is log from event viewer generated at 5:59:01 :
The process winlogon.exe has initiated the restart of computer SATURN on behalf of user INTELATECH\****** for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shutdown Type: restart
Comment:

Does anyone has any ideas ?

 

[AntonKouzoub]

and this is sample from Schedulers log:
"Task Scheduler Service"
Exited at 27/08/2006 5:59:11 AM
"Task Scheduler Service"
Started at 27/08/2006 5:59:50 AM
"Task Scheduler Service"
5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
"Task Scheduler Service"
Exited at 28/08/2006 5:59:13 AM
"Task Scheduler Service"
Started at 28/08/2006 5:59:50 AM
"Task Scheduler Service"
5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
"Task Scheduler Service"
Exited at 29/08/2006 5:59:16 AM
"Task Scheduler Service"
Started at 29/08/2006 5:59:53 AM
"Task Scheduler Service"
5.2.3790.1830 (srv03_sp1_rtm.050324-1447)

 

[Roadki11]

I have 2 ideas for you. First, the shutdown.exe can be run from a different computer on the network and reboot that server. Wondering if someone scheduled the reboot from a different server. Second, change the password on that user identified, if the credentials dont match then it wont execute the job.

RoadKi11

 

[AntonKouzoub]

thanks, looks like it was running from other server. when i spoke with the guy who set it up he told me that it was local