Home

Windows Server 2016 shut down for unknown reason

%3CLINGO-SUB%20id%3D%22lingo-sub-921810%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Server%202016%20shut%20down%20for%20unknown%20reason%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-921810%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F430037%22%20target%3D%22_blank%22%3E%40DieterDS%3C%2FA%3EAdding%20two%20more%20screenshots.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-921796%22%20slang%3D%22en-US%22%3EWindows%20Server%202016%20shut%20down%20for%20unknown%20reason%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-921796%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe're%20experiencing%20some%20strange%20behavior%20with%20some%20of%20our%20Windows%20servers.%20For%20unknown%20reason%20they%20seem%20to%20shut%20down.%3C%2FP%3E%3CP%3EThis%20occurred%20while%20we%20were%20executing%20tests%20via%20Azure%20DevOps%20pipelines.%20(not%20sure%20if%20related)%3C%2FP%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%3CSTRONG%3EEventID%3A%3C%2FSTRONG%3E%201074%3C%2FP%3E%3CP%3E%3CFONT%3EThe%20process%20C%3A%5Cwindows%5CSystem32%5Csvchost.exe%20(sp-na-re-m80-1)%20has%20initiated%20the%20shutdown%20of%20computer%20sp-na-re-m80-1%20on%20behalf%20of%20user%20NT%20AUTHORITY%5CSYSTEM%20for%20the%20following%20reason%3A%20Other%20(Planned)%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%3CBR%20%2F%3E%3CSTRONG%3EReason%20Code%3A%3C%2FSTRONG%3E%200x80000000%3C%2FFONT%3E%3CFONT%3E%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%3CBR%20%2F%3E%3CSTRONG%3EShutdown%20Type%3A%3C%2FSTRONG%3E%20shutdown%20%3C%2FFONT%3E%3CFONT%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%3CSTRONG%3EComment%3A%3C%2FSTRONG%3E%20C%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20done%20a%20little%20investigation%2C%20see%20the%20screenshots%20attached.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20hoping%20someone%20can%20shine%20a%20light%20on%20this%20and%20guide%20me%20towards%20the%20root%20cause%20of%20the%20shutdown.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-921796%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-951865%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Server%202016%20shut%20down%20for%20unknown%20reason%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-951865%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F430037%22%20target%3D%22_blank%22%3E%40DieterDS%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20there%2C%3CBR%20%2F%3Eseeing%20your%20screenshot%2C%20I%20went%20here%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2Fshutdown%2Fsystem-shutdown-reason-codes%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2Fshutdown%2Fsystem-shutdown-reason-codes%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eand%20checked%20for%20shutdown%20codes%20again%20and%20found%20this%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3ESHTDN_REASON_FLAG_PLANNED%0A0x80000000%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%3CBR%20%2F%3EThe%20shutdown%20was%20planned.%20The%20system%20generates%20a%20System%20State%20Data%20(SSD)%20file.%20This%20file%20contains%20system%20state%20information%20such%20as%20the%20processes%2C%20threads%2C%20memory%20usage%2C%20and%20configuration.%3CBR%20%2F%3EIf%20this%20flag%20is%20not%20present%2C%20the%20shutdown%20was%20unplanned.%20Notification%20and%20reporting%20options%20are%20controlled%20by%20a%20set%20of%20policies.%20For%20example%2C%20after%20logging%20in%2C%20the%20system%20displays%20a%20dialog%20box%20reporting%20the%20unplanned%20shutdown%20if%20the%20policy%20has%20been%20enabled.%20An%20SSD%20file%20is%20created%20only%20if%20the%20SSD%20policy%20is%20enabled%20on%20the%20system.%20The%20administrator%20can%20use%20Windows%20Error%20Reporting%20to%20send%20the%20SSD%20data%20to%20a%20central%20location%2C%20or%20to%20Microsoft.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ealso%20found%20%3CA%20href%3D%22https%3A%2F%2Fdevblogs.microsoft.com%2Foldnewthing%2F20100831-00%2F%3Fp%3D12993%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%20that%20might%20help%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-964968%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Server%202016%20shut%20down%20for%20unknown%20reason%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-964968%22%20slang%3D%22en-US%22%3EI'm%20not%20sure%20what%20to%20do%20with%20this%20information.%3CBR%20%2F%3EIt%20does%20indeed%20say%20that%20it's%20a%20Planned%20shutdown%2C%20but%20we%20can't%20find%20the%20reason%20as%20to%20why%20it%20occurred.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-965102%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Server%202016%20shut%20down%20for%20unknown%20reason%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-965102%22%20slang%3D%22en-US%22%3EYes%2C%20sorry%20about%20that%2C%20hope%20someone%20else%20can%20help%20you%20further%20with%20it%20(%3A%3C%2FLINGO-BODY%3E
DieterDS
New Contributor

Hello All,

 

We're experiencing some strange behavior with some of our Windows servers. For unknown reason they seem to shut down.

This occurred while we were executing tests via Azure DevOps pipelines. (not sure if related)

 

EventID: 1074

The process C:\windows\System32\svchost.exe (sp-na-re-m80-1) has initiated the shutdown of computer sp-na-re-m80-1 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned)                                                                                                                              
Reason Code: 0x80000000
                                                                                                                         
Shutdown Type: shutdown
                                                                                                                        Comment: C

 

I've done a little investigation, see the screenshots attached.

 

I'm hoping someone can shine a light on this and guide me towards the root cause of the shutdown.

4 Replies

@DieterDSAdding two more screenshots.

@DieterDS 

 

Hi there,
seeing your screenshot, I went here

 

https://docs.microsoft.com/en-us/windows/win32/shutdown/system-shutdown-reason-codes

 

and checked for shutdown codes again and found this:

 

SHTDN_REASON_FLAG_PLANNED
0x80000000


The shutdown was planned. The system generates a System State Data (SSD) file. This file contains system state information such as the processes, threads, memory usage, and configuration.
If this flag is not present, the shutdown was unplanned. Notification and reporting options are controlled by a set of policies. For example, after logging in, the system displays a dialog box reporting the unplanned shutdown if the policy has been enabled. An SSD file is created only if the SSD policy is enabled on the system. The administrator can use Windows Error Reporting to send the SSD data to a central location, or to Microsoft.

 

also found this that might help

I'm not sure what to do with this information.
It does indeed say that it's a Planned shutdown, but we can't find the reason as to why it occurred.
Yes, sorry about that, hope someone else can help you further with it (:
Related Conversations
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
7 Replies