Hay11Mac Posted June 25, 2015 Posted June 25, 2015 Hey Peeps Recently we've had a few PC's that will turn off randomly normally when idle and around the same kinda time each day. Users get a popup (See below) stating that "Windows will shut down in 1 minute" We only have one scheduled task that turns all PC's off at 8pm @ night, but even removing this task doesn't resolve the issue. Any ideas??? Thanks in advance Hay Popup:
sted Posted June 25, 2015 Posted June 25, 2015 scheduled task using the shutdown command either remotely or locally, windows updates have been installed possibly but the box dosent look right it looks more like a shutdown command to me
unixman_again Posted June 25, 2015 Posted June 25, 2015 I can't help you with this but this week we've been seeing a message "Device has been disconnected" on bootup. Methinks that a dodgy update come in.
SteveM555 Posted June 25, 2015 Posted June 25, 2015 Try checking the Time/Date on the PCs to make sure they're all correct. Also, make sure you're not allowing students to access the remote shutdown through command prompt.
Davit2005 Posted June 25, 2015 Posted June 25, 2015 I've seen similar message when doing a GPUPDATE and when selecting Yes to restart PC.
jinnantonnixx Posted June 25, 2015 Posted June 25, 2015 Probably cohorts doing a remote shutdown. Here's a discussion and solution. windows 7 - My colleague often shuts down my machine through the LAN - how do I prevent it? - Super User
Hay11Mac Posted June 25, 2015 Author Posted June 25, 2015 But the thing is it's not just one PC - it's quite a few
zag Posted June 25, 2015 Posted June 25, 2015 Its maybe a virus, check the PC with a virus checker and check the registry for auto loading files in the run section
MMPS Posted June 25, 2015 Posted June 25, 2015 If it's happening on multiple PC's at the same time, it does look like someone is running the remote shutdown dialog box and select multiple computers at once. The problem is, disabling the cmd prompt isn't enough to stop someone running the remote shutdown command. Try finding the group policy Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment "Force shutdown from a remote system" and remove rights from everyone (even Admins), this will disable the ability to remotely shut down the PC. If this doesn't work, at least you will know that it is being shutdown locally from the machine rather than over the network.
Hay11Mac Posted June 25, 2015 Author Posted June 25, 2015 Nothing specified in there - Define these policy settings is unticked and no users / group added It's happening to multiple computers at the same time, normally when idle - or where they have been idle for sometime Confused - It's frustrating many people
Hay11Mac Posted June 25, 2015 Author Posted June 25, 2015 (edited) Am I able to put a policy in place that will stop the shutdown? if I can't find where or who is shutting it down Actually thinking about it that won't work as we have a policy in place to force shutdown at 8pm. Plucking at straws - as I'm at a loss Edited June 25, 2015 by Hay11Mac
MMPS Posted June 25, 2015 Posted June 25, 2015 if the policy isn't defined, then the default is that anyone with local admin rights on that PC can remotely shutdown. If you tick the box to define the policy, it will overwrite the defaults, and if there are no users selected, you are effectively denying everyone the right to remotely shutdown. Also, is anything suspicious showing up in task manager that may indicate a power saving software running in the background that is shutting them down?
Mark182 Posted June 25, 2015 Posted June 25, 2015 We had an issue where if a user manually shut down a device when it was next turned on and logged in it would try and run our "shut down" as it had not been run at our set time, if that makes sense. Not sure if you have kind of the same issue.
Joanne Posted June 25, 2015 Posted June 25, 2015 I've seen similar message when doing a GPUPDATE and when selecting Yes to restart PC. ^^ This. Could there be a script which is running gpupdate? - - - Updated - - - We had an issue where if a user manually shut down a device when it was next turned on and logged in it would try and run our "shut down" as it had not been run at our set time, if that makes sense. Not sure if you have kind of the same issue. ^^ Also this!!
Hay11Mac Posted June 25, 2015 Author Posted June 25, 2015 I've not ticked Define these policy settings - but not selected any users / groups - will this interfere with the policy we have to shutdown the PC's at a specific time?
Joanne Posted June 25, 2015 Posted June 25, 2015 Yeah it will probably stop the policy from running. Might be worth testing a couple of machines by shutting them down now and seeing if they pop up with the error message tomorrow....
Hay11Mac Posted June 25, 2015 Author Posted June 25, 2015 A gupdate was running on the machine @ 8.43 and the affected PC's seem to turn off between 8 - 9 normally everyday (But not always)
Hay11Mac Posted June 25, 2015 Author Posted June 25, 2015 On one of the affected PC's I have disabled the gupdate to see if that resolves the issue - also I have turned off the Customer Experience Program as I have read that might also be causing issues - I will report back tomorrow or monday
psydii Posted June 25, 2015 Posted June 25, 2015 [ATTACH=CONFIG]31272[/ATTACH] Could it be this?????? No. That is just the VSS service shutting down.
synaesthesia Posted June 25, 2015 Posted June 25, 2015 What was that virus a while ago that exhibited this as a symptom.. Sasser?
Bruce123 Posted June 25, 2015 Posted June 25, 2015 It sounds like a virus, or someone has the local admin password or a domain account with above basic rights. In my experience shutdowns that were initiated by shutdown.exe log an event in the event log (and would also give the username). Thanks, Bruce.
Hay11Mac Posted June 26, 2015 Author Posted June 26, 2015 After disabling gupdate is Services the normal affected machines never went off this morning - could this be resolved? I will update on Monday
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now