Windows Server 2016 shut down for unknown reason

Copper Contributor

Hello All,

 

We're experiencing some strange behavior with some of our Windows servers. For unknown reason they seem to shut down.

This occurred while we were executing tests via Azure DevOps pipelines. (not sure if related)

 

EventID: 1074

The process C:\windows\System32\svchost.exe (sp-na-re-m80-1) has initiated the shutdown of computer sp-na-re-m80-1 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned)                                                                                                                              
Reason Code: 0x80000000
                                                                                                                         
Shutdown Type: shutdown
                                                                                                                        Comment: C

 

I've done a little investigation, see the screenshots attached.

 

I'm hoping someone can shine a light on this and guide me towards the root cause of the shutdown.

8 Replies

@DieterDSAdding two more screenshots.

@DieterDS 

 

Hi there,
seeing your screenshot, I went here

 

https://docs.microsoft.com/en-us/windows/win32/shutdown/system-shutdown-reason-codes

 

and checked for shutdown codes again and found this:

 

SHTDN_REASON_FLAG_PLANNED
0x80000000


The shutdown was planned. The system generates a System State Data (SSD) file. This file contains system state information such as the processes, threads, memory usage, and configuration.
If this flag is not present, the shutdown was unplanned. Notification and reporting options are controlled by a set of policies. For example, after logging in, the system displays a dialog box reporting the unplanned shutdown if the policy has been enabled. An SSD file is created only if the SSD policy is enabled on the system. The administrator can use Windows Error Reporting to send the SSD data to a central location, or to Microsoft.

 

also found this that might help

I'm not sure what to do with this information.
It does indeed say that it's a Planned shutdown, but we can't find the reason as to why it occurred.
Yes, sorry about that, hope someone else can help you further with it (:

Hi @DieterDS 

 

Did you ever found out what the cause was?, I have 2 servers which gave the same event but cant found out why they rebooted.

Tiene pinta de ser una tarea programada. Cuando lanza el apagado el usuario System suele ser por eso.

Hi @MiguelSalinas 

 

(thx to google translate) this is not a scheduled task. But I found out for 1 server there was a Azure task which does bring the server down at night and starts it up in the morning.. 1 down, 1 to go :)

i`m glad to read that :)