Windows server powered off automatically

Question

Hello,

My Windows Server 2019 is powering off automatically. Upon checking the Event Viewer logs, I found that the shutdown was initiated by the SYSTEM user.

This issue is impacting our production environment, and I need to identify the root cause and resolve it as soon as possible.

Could anyone please advise on the possible reasons for this behavior and the steps to fix it?

System logs:-

Log Name: System

Source: User32

Date: 1/14/2025 2:31:33 PM

Event ID: 1074

Task Category: None

Level: Information

Keywords: Classic

User: SYSTEM

Computer: <COMPUTER-NAME>

Description:

The process C:\Windows\system32\winlogon.exe (<COMPUTER-NAME>) has initiated the power off of computer <COMPUTER-NAME> on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found

Reason Code: 0x500ff

Shutdown Type: power off

Comment:

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="User32" Guid="{b0aa8734-56f7-41cc-b2f4-de228e98b946}" EventSourceName="User32" />

<EventID Qualifiers="32768">1074</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2025-01-14T09:01:33.331267200Z" />

<EventRecordID>198616</EventRecordID>

<Correlation />

<Execution ProcessID="408" ThreadID="3780" />

<Channel>System</Channel>

<Computer>MSAPPSERVER3</Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="param1">C:\Windows\system32\winlogon.exe (<COMPUTER-NAME>)</Data>

<Data Name="param2"><COMPUTER-NAME></Data>

<Data Name="param3">No title for this reason could be found</Data>

<Data Name="param4">0x500ff</Data>

<Data Name="param5">power off</Data>

<Data Name="param6">

</Data>

<Data Name="param7">NT AUTHORITY\SYSTEM</Data>

</EventData>

</Event>

Answer 1

• User: NT AUTHORITY\SYSTEM
• Process: C:\Windows\system32\winlogon.exe
• Reason Code: 0x500ff
• Shutdown Type: power off

Here’s a breakdown of what might be happening:

Possible Causes

Windows Update:

• A common cause for an automatic shutdown triggered by winlogon.exe is that Windows is initiating a system restart due to pending updates, which may have been installed or required a reboot. This could be due to either a Critical Update or Cumulative Update.

Scheduled Tasks:

  - A scheduled task could be running at a set time that causes the system to shut down, especially tasks like maintenance or updates. The **SYSTEM** account is often used for scheduled tasks that require elevated privileges.
  
  **Power Management Settings**:
  
     - A misconfigured power setting or an application that incorrectly triggers shutdowns. Some power management configurations or third-party applications could cause this issue.
     
     **Event Triggered by Another Service**:
     
        - Another possibility is that a background service or script is issuing the shutdown command. For example, certain enterprise software, backup software, or even antivirus solutions can trigger system restarts or shutdowns.
        
        **Corrupted System Files**:
        
           - System files responsible for power management or shutdown could have become corrupted, leading to unexpected shutdown behavior.
           

Steps to Diagnose and Resolve the Issue

Check Windows Update History:

• Navigate to Settings > Update & Security > Windows Update and check the Update History for any recent updates that might have triggered the restart.
  • If a critical update or cumulative update was installed recently, it could be related to the shutdown.
  Review Scheduled Tasks:

  - Open **Task Scheduler** and look through the scheduled tasks, especially those triggered by the **SYSTEM** account.
  
     - Check if any tasks have been scheduled to perform shutdowns or restarts and investigate their triggers.
  
     **Check System Logs for Further Clues**:
  
        - Review the **System** logs in **Event Viewer** for other events around the time of the shutdown. Look for warnings or errors that might point to a specific service, task, or application causing the shutdown.
  
           - Look for other Event IDs, like `41` (Kernel-Power), which might indicate an unexpected shutdown.
  
           **Check Power Settings**:
  
              - Go to **Control Panel** > **Power Options** and review the power plan settings. Ensure that settings like **sleep**, **hibernation**, or **shutdown** are properly configured and not set to initiate power off automatically.
  
                 - You may also check the **Advanced Power Settings** to see if there's an issue with any custom power management configurations.
  
                 **Use Event ID 6006 (Shutdown Event)**:
  
                    - Look for **Event ID 6006** (shutdown event) in the **Event Viewer** as it will give you more information on what caused the system to shut down, like if it was triggered by a specific application or process.
  

1. System Integrity Check:
   • Run System File Checker (SFC) to ensure no system files are corrupted:
   • User: NT AUTHORITY\SYSTEM
   • Process: C:\Windows\system32\winlogon.exe
   • Reason Code: 0x500ff
   • Shutdown Type: power off
   • Here’s a breakdown of what might be happening: Possible Causes

       **Windows Update**:
     
                - A common cause for an automatic shutdown triggered by `winlogon.exe` is that Windows is initiating a system restart due to pending updates, which may have been installed or required a reboot. This could be due to either a **Critical Update** or **Cumulative Update**.
     
                      **Scheduled Tasks**:
     
                               - A scheduled task could be running at a set time that causes the system to shut down, especially tasks like maintenance or updates. The **SYSTEM** account is often used for scheduled tasks that require elevated privileges.
     
                                     **Power Management Settings**:
     
                                              - A misconfigured power setting or an application that incorrectly triggers shutdowns. Some power management configurations or third-party applications could cause this issue.
     
                                                    **Event Triggered by Another Service**:
     
                                                             - Another possibility is that a background service or script is issuing the shutdown command. For example, certain enterprise software, backup software, or even antivirus solutions can trigger system restarts or shutdowns.
     
                                                                   **Corrupted System Files**:
     
                                                                            - System files responsible for power management or shutdown could have become corrupted, leading to unexpected shutdown behavior.
     

     Steps to Diagnose and Resolve the Issue Check Windows Update History:

          - Navigate to **Settings** > **Update & Security** > **Windows Update** and check the **Update History** for any recent updates that might have triggered the restart.
     
                   - If a critical update or cumulative update was installed recently, it could be related to the shutdown.
     
                   **Review Scheduled Tasks**:
     
                            - Open **Task Scheduler** and look through the scheduled tasks, especially those triggered by the **SYSTEM** account.
     
                                     - Check if any tasks have been scheduled to perform shutdowns or restarts and investigate their triggers.
     
                                     **Check System Logs for Further Clues**:
     
                                              - Review the **System** logs in **Event Viewer** for other events around the time of the shutdown. Look for warnings or errors that might point to a specific service, task, or application causing the shutdown.
     
                                                       - Look for other Event IDs, like `41` (Kernel-Power), which might indicate an unexpected shutdown.
     
                                                       **Check Power Settings**:
     
                                                                - Go to **Control Panel** > **Power Options** and review the power plan settings. Ensure that settings like **sleep**, **hibernation**, or **shutdown** are properly configured and not set to initiate power off automatically.
     
                                                                         - You may also check the **Advanced Power Settings** to see if there's an issue with any custom power management configurations.
     
                                                                         **Use Event ID 6006 (Shutdown Event)**:
     
                                                                                  - Look for **Event ID 6006** (shutdown event) in the **Event Viewer** as it will give you more information on what caused the system to shut down, like if it was triggered by a specific application or process.
     

   1. System Integrity Check:
      • Run System File Checker (SFC) to ensure no system files are corrupted:
        Check for Third-party Software:

              - If you recently installed any third-party software or have certain enterprise tools running, ensure that these applications are not misconfigured to trigger a shutdown. You could temporarily disable or uninstall them for testing purposes.
        

      Check Group Policy Settings:
      • If your server is part of a domain, check for any Group Policy settings that might be configured to cause a shutdown or restart under certain conditions. Look for policies related to Windows Update, shutdown behavior, or maintenance.

Answer 2

Hello,

Please refer to the information below about this issue.

Incorrect shutdown reason code - Windows Server | Microsoft Learn

Best Regards,

Hania Lian

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.