win2k adv server keeps restarting by itself

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

wE HAVE WINDOWS 2000 aDVANCED SERVER WITH SP4. LAST UPDATES WERE DONE 8
MONTHS BACK.

i DID UPGRADE OUR RAM TO 3GB FROM 1GB 3 WEEKS BACK.

NOW WE HAVE THIS PROBLEM THAT OUR SERVER KEEPS RESTARTING ON ITS OWN. I am
trying to find out the cause of this but havent suceeded. this happens 2
times between 13:00 & 14:00.

how do i find out what is causing this problem & how can i resolve this?

is there a way to disable my main server from accepting rpc or net send msgs
from our LAN for shutdowns.

i need to trace this issue & any assistance on this matter will be highly
appreciated.

we have a file server, exchange server & a 2ndary DC. only the file server
(pdc) has this problem.

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Make sure that auditing of system events is enabled on the server along with
logon events. That may provide you with clues as to what is happening. Also
be sure to check the system and application logs for any pertinent info. You
may also want to enable auditing of process tracking on a temporary basis to
see if a particular process is happening at the time of the reboots. Process
tracking can cause a lot of events to be recorded in the security log so I
would not leave it enabled all the time and be sure to increase the size of
the security log quite a bit. Reboots can be a hardware problem but if it
happens at specific times then that is somewhat doubtful. Power brownouts
can cause this to happen such as if a floor scrubbing crew plugs there 20
amp floor buffer into the same circuit as the server. If someone can sit and
monitor the server it might be worthwhile to run a program like Process
Explorer from SysInternals to watch what is going on but it is possible that
a process may cause the reboot before it shows on the screen for Process
Explorer. Shutdown messages should cause events to be recorded in the
security and system log showing the user and computer that initiated the
action. A graceful reboot could indicate a remote shutdown while a "crash"
reboot could indicate a problem with power, hardware problem, or severe
process conflict..--- Steve


"sphilip" <sphilip@discussions.microsoft.com> wrote in message
news:1E9D3B27-9ADB-4A27-A446-C9ED4C3EDEEE@microsoft.com...
> wE HAVE WINDOWS 2000 aDVANCED SERVER WITH SP4. LAST UPDATES WERE DONE 8
> MONTHS BACK.
>
> i DID UPGRADE OUR RAM TO 3GB FROM 1GB 3 WEEKS BACK.
>
> NOW WE HAVE THIS PROBLEM THAT OUR SERVER KEEPS RESTARTING ON ITS OWN. I am
> trying to find out the cause of this but havent suceeded. this happens 2
> times between 13:00 & 14:00.
>
> how do i find out what is causing this problem & how can i resolve this?
>
> is there a way to disable my main server from accepting rpc or net send
> msgs
> from our LAN for shutdowns.
>
> i need to trace this issue & any assistance on this matter will be highly
> appreciated.
>
> we have a file server, exchange server & a 2ndary DC. only the file server
> (pdc) has this problem.

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

You may wish to consider running a health check to see if it were infected
with worm/virus such as Sasser at:

http://www.microsoft.com/security/incident/sasser.mspx

or try tools such as:

http://www.microsoft.com/security/malwareremove/default.mspx
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html


Do let us know if this helps. thanks!


"sphilip" wrote:

> wE HAVE WINDOWS 2000 aDVANCED SERVER WITH SP4. LAST UPDATES WERE DONE 8
> MONTHS BACK.
>
> i DID UPGRADE OUR RAM TO 3GB FROM 1GB 3 WEEKS BACK.
>
> NOW WE HAVE THIS PROBLEM THAT OUR SERVER KEEPS RESTARTING ON ITS OWN. I am
> trying to find out the cause of this but havent suceeded. this happens 2
> times between 13:00 & 14:00.
>
> how do i find out what is causing this problem & how can i resolve this?
>
> is there a way to disable my main server from accepting rpc or net send msgs
> from our LAN for shutdowns.
>
> i need to trace this issue & any assistance on this matter will be highly
> appreciated.
>
> we have a file server, exchange server & a 2ndary DC. only the file server
> (pdc) has this problem.