How to diagnose unclean shutdown

-

i have number of seem identical virtual machines on esx running windows server 2008.  after sort of 'event' (hard shutdown of hypervisor), of these vms asking upon startup why shutdown machine.  answer, , seems happy.  go restart vms, , (as expected) ask why i'm restarting.

here gets odd... though shutdown part of restart seems go perfectly, upon login system asks why system had been shutdown.  behavior indicates unclean shutdown.  tells me restart, appeared clean, apparently failed along way , therefore didn't clean 2 files tell windows clean shutdown occurred.

this 2 part question:

- how can 1 tell clean shutdown failed?  (i've combed through event logs , don't see helpful)

- has seen , been able fix (nope, no av software or rim software... see various people talking being guilty party)?

thanks!

hi,

i checked errors mentioned in log , here of them:

error   12/13/2014 8:27:30   microsoft-windows-grouppolicy   1006    none    processing of group policy failed. windows not authenticate active directory service on domain controller. (ldap bind function call failed). in details tab error code , description. error   12/13/2014 8:23:47   microsoft-windows-terminalservices-printers     1111    none    driver adobe pdf converter required printer adobe pdf classauthor unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:45   microsoft-windows-terminalservices-printers     1111    none    driver adobe pdf converter required printer adobe pdf unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:44   microsoft-windows-terminalservices-printers     1111    none    driver infoprint 1000 series required printer lab office unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:43   microsoft-windows-terminalservices-printers     1111    none    driver ibm infoprint 1000 series ps3 required printer uspttlaj color-901k-09-11 stanwix-pittsburgh unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:43   microsoft-windows-terminalservices-printers     1111    none    driver infoprint 1870 mfp ps3 required printer uspttlah-902f-09-11 stanwix-pittsburgh unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:42   microsoft-windows-terminalservices-printers     1111    none    driver snagit 8 printer required printer snagit 8 unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:42   microsoft-windows-terminalservices-printers     1111    none    driver fax - hp officejet pro 8500 a910 required printer fax - hp officejet pro 8500 a910 (network) unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:41   microsoft-windows-terminalservices-printers     1111    none    driver hp officejet pro 8500 a910 required printer hp officejet pro 8500 a910 (network) unknown. contact administrator install driver before log in again. error   12/13/2014 8:23:39   microsoft-windows-grouppolicy   1079    none    processing of group policy failed. windows not obtain list of group policy objects applicable computer or user. view event details more information. error   12/13/2014 8:16:41   netbt   4321    none    "the name ""ws2008r2x64    :0"" not registered on interface ip address 172.16.80.1. computer ip address 172.16.80.86 did not allow name claimed computer." error   12/13/2014 8:16:25   microsoft-windows-dfssvc        14550   none    dfs namespace service not initialize cross forest trust information on domain controller, periodically retry operation. return code in record data. error   12/13/2014 8:16:10   server  2505    none    server not bind transport \device\netbt_tcpip_{f4224b2d-666a-49d7-8dad-3e6fdb2b2f34} because computer on network has same name.  server not start. error   12/13/2014 8:16:01   eventlog        6008    none    previous system shutdown @ 8:15:31 on ?12/?13/?2014 unexpected.

from these logs can see components mentioned, including terminal services, group policys, dfs namespace , computer name/ip assignment.

first make sure if real issue computer name duplicated computer. there 2 errors mentioned same issue:

 the server not bind transport \device\netbt_tcpip_{f4224b2d-666a-49d7-8dad-3e6fdb2b2f34} because computer on network has same name.  the server not start

name ""ws2008r2x64    :0"" not registered on interface ip address 172.16.80.1. computer ip address 172.16.80.86 did not allow name claimed computer."

please try rename computer different 1 see if issue fixed. 

please remember mark replies answers if , un-mark them if provide no help. if have feedback technet support, contact tnmff@microsoft.com.



Windows Server  >  Windows Server General Forum



Comments

Post a Comment

Popular posts from this blog

Group Policy Event ID 1058 Error Code 1326 (The user name or password is incorrect)

-
i seeing odd error on 1 of our domain controllers. have dealt event id 1058 errors whereby policy (or policies) not replicating, receiving error along error code 1326 on server, , apparently happening default domain policy: log name:      system source:        microsoft-windows-grouppolicy date:          8/10/2015 3:09:54 pm event id:      1058 task category: none level:         error keywords:      user:          s-1-5-21-1484152634-2550175353-3916092219-3287 computer:      <dc name>.<domainname> description: processing of group policy failed. windows attempted read file http://schemas.microsoft.com/win/2004/08/events/event ">   <system>     <provi...
Read more

Suspicious event log Event ID: 4905

-
hi thr, could please me understand causing such event logs generate ? as  i understand, vssvc.exe pertains volume shadow copy used backup purpose.  we have third party application used taking backup of servers. the event longs generated following messages: 1) attempt made unregister security event source. 2) attempt made register security event source. these events not regular generated on random days. standard fields: date:               2013/10/19 time:               02:32:19 importance:         critical rule name:          security event monitored machine:  <domain controller> log format:         windows log name:           security event id:           4905 in work hours:      yes dynamic fields: internal timestamp: 2013/10/19 ...
Read more

DCOM received error "2147746132" from...

-
hi everybody, i have dc (my windows essentials 2012 server) , windows 2012 server in network.  the windows server 2012 inside domain. on server, got "non stopping" error says in event logs : ===> dcom received error "2147746132" fromd computer xxxx(my dc computer) while server trying activation : {6df8cb71-153b-4c66-8fc4-e59301b8011b} it never stops, got 11000+ new events :s i found : http://support.microsoft.com/kb/971153/fr i'm not sure should ? does got idea ? matthieu. hi, please try solution mentioned in below link: http://www.eventid.net/display-eventid-10006-source-dcom-eventno-272-phase-1.htm regards, cicely Windows Server  >  Windows Server 2012 General ...
Read more