Forum Discussion

Christopher_A's avatar
Christopher_A
Copper Contributor
Feb 08, 2019

Virtual machine shutdown in Azure

Hello,

 

I have been searching all over the internet to try and find a solution to a problem I got with some Virtual Machines in Azure. They are randomly shutting down and I can't find a solution to it, and I hope someone here can point me in the right direction.

 

Currently got 4 virtual machines deployed:

B2MS - Windows 10 Pro - With Office and Microsoft Nav 2009R2 installed - Domain joined with Azure AD DS

The machines is shutting down randomly, up to 7-8 times a day. 

 

This is the information I am getting from the eventlog:

Loggnavn: System
Kilde: User32
Dato: 07.02.2019 15:12:30
Hendelses-ID: 1074
Oppgavekategori:Ingen
Nivå: Information
Nøkkelord: Classic
Bruker: S-1-5-21-3361540728-1458010002-743927306-1111
Datamaskin: VDI3.lorentzen.no
Beskrivelse:
Prosessen C:\Windows\System32\RuntimeBroker.exe (VDI3) has initiated Shutdown for computer VDI3 on behalf of user domain\user for the following reason: Other (Unplanned)
Årsakskode: 0x0
Avslutningstype: Shutdown
Kommentar:
Hendelses-XML-fil:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="User32" Guid="{b0aa8734-56f7-41cc-b2f4-de228e98b946}" EventSourceName="User32" />
<EventID Qualifiers="32768">1074</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2019-02-07T14:12:30.413409200Z" />
<EventRecordID>8934</EventRecordID>
<Correlation />
<Execution ProcessID="492" ThreadID="508" />
<Channel>System</Channel>
<Computer>VDI3.lorentzen.no</Computer>
<Security UserID="S-1-5-21-3361540728-1458010002-743927306-1111" />
</System>
<EventData>
<Data Name="param1">C:\Windows\System32\RuntimeBroker.exe (VDI3)</Data>
<Data Name="param2">VDI3</Data>
<Data Name="param3">Other (Unplanned)</Data>
<Data Name="param4">0x0</Data>
<Data Name="param5">Shutdown</Data>
<Data Name="param6">
</Data>
<Data Name="param7">LORENTZEN\radek</Data>
</EventData>
</Event>

 

(I have translated the important parts of the event log)

 

I have googled as much as I can and I have tried the following fixes.

  • Disable automatic Windows update
  • Manually updated windows
  • Disable TimeBrokerSvc in regedit
  • Turned of every option like "Download updates from other computers"
  • Ran stresstest to see if it triggers on high CPU usage
  • Killed the RuntimeBroker process

 

I have ran out of ideas and the customer is starting to get annoyed by the random shutdowns. 

 

Anyone that have experienced this either on-premises or in Azure and anyone know what the problem can be?

 

 

Thanks in advance.

 

 

2 Replies

Resources