One of our server has been shutdown unknowingly, I was investigating, which
account is responsible for that.



There was a clean shutdown of the system at specific time (event IDs 6005
and 6006 suggest this; also, there is no event ID 6008 which would indicate
a "dirty" shutdown). The user logoff event (event ID 538) immediately
preceding the system shutdown event, is not matching with any of the user
logon events (event ID 528).



Kindly advice is there any other way we can find the culprit (in windows
2000 server).



Thanks,



Raman

If no BSOD's occur (Event ID: 1001 Source: Save Dump), then it may be a
power problem. I would look at a possible faulty (or undersized) pc power
supply, UPS, bad battery, or the circuit feeding the outlet that the pc is
plugged into.

Also check the cmos setup power settings.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Raman" wrote:

Quote:

One of our server has been shutdown unknowingly, I was investigating, which account is responsible for that. There was a clean shutdown of the system at specific time (event IDs 6005 and 6006 suggest this; also, there is no event ID 6008 which would indicate a "dirty" shutdown). The user logoff event (event ID 538) immediately preceding the system shutdown event, is not matching with any of the user logon events (event ID 528). Kindly advice is there any other way we can find the culprit (in windows 2000 server). Thanks, Raman

As I've mentioned early, No BSOD /No Memory.dmp, it's a clean shutdown of
the system at specific time. Here I'm trying to find who has logged in to
the server during that time.


Thanks,

-Raman

"Dave Patrick" <DSPatrick@nospam.gmail.com> wrote in message
news:640D1C52-0CA2-4394-BE09-15921C518E56@microsoft.com...

Quote:

If no BSOD's occur (Event ID: 1001 Source: Save Dump), then it may be a power problem. I would look at a possible faulty (or undersized) pc power supply, UPS, bad battery, or the circuit feeding the outlet that the pc is plugged into. Also check the cmos setup power settings. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "Raman" wrote: One of our server has been shutdown unknowingly, I was investigating, which account is responsible for that. There was a clean shutdown of the system at specific time (event IDs 6005 and 6006 suggest this; also, there is no event ID 6008 which would indicate a "dirty" shutdown). The user logoff event (event ID 538) immediately preceding the system shutdown event, is not matching with any of the user logon events (event ID 528). Kindly advice is there any other way we can find the culprit (in windows 2000 server). Thanks, Raman

This link may help.

http://technet2.microsoft.com/windowsserver/en/library/e104c96f-e243-41c5-aaea-d046555a079d1033.mspx?mfr=true



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Raman" wrote:

Quote:

As I've mentioned early, No BSOD /No Memory.dmp, it's a clean shutdown of the system at specific time. Here I'm trying to find who has logged in to the server during that time. Thanks, -Raman