Shutdown with minor causes 0x84010001 and 0x80070020



Hello,

I'm investigating a server that recently shut down and it is unclear what or
who shut it down. I have the following events:

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 29-11-2006
Time: 18:19:33
User: S-1-5-21-2718388043-1283238250-2015309376-500
Computer: MYSERVER
Description:
The process Explorer.EXE has initiated the restart of MYSERVER for the
following reason: Hardware: Maintenance (Planned)
Minor Reason: 0x84010001
Shutdown Type: shutdown
Comment:

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 01 00 01 84 ...?


Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 29-11-2006
Time: 18:24:20
User: NT AUTHORITY\SYSTEM
Computer: MYSERVER
Description:
The process svchost.exe has initiated the restart of MYSERVER for the
following reason: No title for this reason could be found
Minor Reason: 0x80070020
Shutdown Type: power off
Comment:

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 20 00 07 80 ..?

What puzzles me is that these events don't mention "on behalf of" what user
the shutdown was triggered. Does anyone know how to dig further into the
cause of this?

Thank you very much


.



Relevant Pages

  • Re: Help - store wont mount!
    ... Computer: myserver ... Contact your support personnel or package vendor. ... Event Type: Information ... Event Source: Application Management ...
    (microsoft.public.exchange.admin)
  • Re: Help - store wont mount!
    ... Event Source: MsiInstaller ... Computer: myserver ... Event Type: Warning ... " on the Microsoft Exchange Information Store. ...
    (microsoft.public.exchange.admin)
  • Re: Help - store wont mount!
    ... Event Source: MsiInstaller ... Computer: myserver ... Event Type: Warning ... " on the Microsoft Exchange Information Store. ...
    (microsoft.public.exchange.admin)
  • Lots of error installing SP1 for Exchange Server 2003 on my SBS2003
    ... Event Source: Microsoft Exchange Server ... Computer: MYSERVER ... see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ... Event Type: Information ...
    (microsoft.public.exchange.admin)
  • Re: The Remote Procedure Call (RPC) service terminated unexpectedly.
    ... Event Type: Information ... The process winlogon.exe has initiated the restart of computer WJFF-DS1 ... for this reason could be found ... Windows must now restart because the Remote Procedure Call ...
    (microsoft.public.windows.server.general)