No Explorer and rebooting server

[cgiuk]

Just had a strange one and would really be grateful of any help.

The primary school that I work at has a single server which carries out all the roles on our network and runs Server 2008 R2.

This afternoon, while using the Print Management tool, the server very suddenly closed everything on the screen and rebooted itself. Once it had finished rebooting, I tried logging back on as administrator - it went through the standard 'applying settings' and 'preparing desktop' but I was then given a blue screen with the mouse cursor. When I do a Ctrl+Alt+Del, I get the task manager and from there I am able to run explorer and my desktop is shown. However, I then tried to open a command prompt and the server rebooted itself again. I've just tried doing the same thing and again, it doesn't show an explorer and once I have explorer open, the moment I try to open a command prompt, the server reboots itself.

Has anyone got any ideas? I'm slightly concerned as this is our only server.

[Jamman960]

I'd start off by checking the Event log, hopefully there should be a hint as to why its restarting.

Other than that I'd trace your steps - have any settings been changed recently? any updates? any hardware changes?

James

[cgiuk]

Hi james,

Thanks for the reply. I've been into the event log and checked to see if there was anything major but there doesn't seem to be. As for tracing my steps, we've done very little on the server recently other than creating a couple of shared folders.

Sam

[Jamman960]

Odd, does it shutdown properly or just cut the power and then come back up and ask for a reboot reason?

[cgiuk]

James,

Excuse my totally none technical explanation but it seems to reboot correctly, certainly not a power issue. The only thing is that it seems to do it very very quickly. Where a standard server reboot would take a while as processes are stopped etc, this takes literally 3 seconds (it flies through the screens stopping processes screens etc)

[cgiuk]

Thanks Jinnan - i'll have another look and try the explicit path when it reboots.

[cgiuk]

Ok, i've just checked the event viewer and I can't find anything about 'the server shutdown unexpectedly'. Sorry to ask this but which section of event viewer would that be stored in?

Also, I've just tried running cmd using an explicit path and it has rebooted in the same way.

[andydis]

is it also used as a terminal server? sounds like spyware.......

try process explorer, malwarebytes, spybot etc