How To Tell What Invoked a Shutdown?

[Gongalong]

Hi folks,

 

I've got a test PC that's shutting down at midnight.

 

Is there any way to tell what invoked the shutdown?

 

Event Viewer just shows when the shutdown occurred, at least in the Security log.

 

It's a VM, but power management is set to "High Performance", and it's a full shut down, rather than a suspend.

 

It's got the NetSupport DNA client installed, but power management is turned off for this particular PC.

 

Thanks

[mikkydoos]

Must be a scheduled task?

 

I'm exploring a similar issue on Windows 7.

[Gongalong]

Nothing in the root of the Task Scheduler Library that's doing a shutdown at least.

[vimagoes]

You should check it in Event Viewer, there you at find the cause

[Gongalong]

I've mentioned above, but when I look in the Security log I just see the shutdown occurring. I don't see a reason for it. Unless there's another log I should be looking at?

[vimagoes]

I see, sorry I did not read that part

Not very familiar with VM environment (I really wish), so I can only suggest a Group Policy applying maybe?.... although it would appears in EV or Task Scheduler .....

 

Is the VM doing some kind of operations that may runs out the memory/disk assigned?

[Gongalong]

IME Hyper-V would never shutdown a VM, and all other VMs are fine. My guess is it's the NetSupport client, although that aspect is supposed to be disabled. It would just be nice to have some proof of what's doing it

[ReadTheNetwork]

In the event viewer within system and ID 1074, does it specify the shutdown type?

[Gongalong]

I can't tell now unfortunately as I've just wiped the VM (being rebuilt with SCCM).

 

If it continues I'll post back.

[Matt_NetSupport]

Hi folks,

 

I've got a test PC that's shutting down at midnight.

 

Is there any way to tell what invoked the shutdown?

 

Event Viewer just shows when the shutdown occurred, at least in the Security log.

 

It's a VM, but power management is set to "High Performance", and it's a full shut down, rather than a suspend.

 

It's got the NetSupport DNA client installed, but power management is turned off for this particular PC.

 

Thanks

 

Hi Gongalong,

 

I have asked our support team to contact you, they should be able to tell you whether NetSupport DNA has a scheduled event to shutdown the VM.

 

Matt

[free780]

I think powercfg has a switch for last source of standby. Not sure about shutdown.

[NetSupportTechSupport]

Hi Gongalong,

 

I can confirm that it is possible to enable additional logging on the DNA Agent component that will help us to determine whether the Shutdown is related to NetSupport DNA. If you are still experiencing the issue with the machine shutting down please enable the DNA Agent logging following the instructions below:

 

1. Open regedit on the DNA Agent machine

2. Navigate to the following location (Note if the Logging key does not exist please create this):

 

HKLM\Software\WOW6432node\NetSupport Ltd\NetSupport DNA\Logging\

 

3. Please then create the two below registry values in the above location:

 

Value name : Client

Value : 1

Vale type : DWORD

 

Value name : PowerMonitor

Value : 1

Vale type : DWORD

 

4. Next restart the NetSupport DNA Agent service

5. This will then create two log files in the following location :

 

C:\Program Files (x86)\NetSupport\NetSupport DNA\Client\

 

Client.log and PowerMonitor.log

 

If you could leave the logging on overnight and then when the PC has shutdown please return the log files to us we will be happy to review this and confirm if there is a shutdown being sent from the DNA Server to the Agent?

 

If you would like to contact the NetSupport support team direct on [email protected] or if you want to PM your contact details we will be happy to help.

 

Logging for the Agent can then be disabled by either removing the two keys above or setting the values to 0 for both followed by a restart of the NetSupport DNA Agent Service.

 

Best Regards

[Gongalong]

Since reimaging it seems to be OK, so possibly just a quirk of the install. I did have 3 PCs with the DNA client installed, and the other two were fine and not shutting down.

 

I'll contact support if it recurs.

 

Thanks all!