PC randomly shuts down rather than log off..

[robk]

Strange one this.

 

I am getting lots of complaints that our pcs are shutting down instead of logging out. Initially I thought it was windows updates pending install (so the normal log out box changes to shutdown).

 

However after digging further the button is defiantly log out, but the machine shuts down.

 

We are running the latest version of Impero and windows 7 64bit.

 

Can anyone suggest any reasons/fixes?!

[ZeroHour]

Does the event log show any clues as to what the shutdown was initiated by?

[robk]

Not really @ZeroHour winlogon.exe has initiated a power off event I'd 1074 reason code 0x500ff is logged. But that's about it.

[ZeroHour]

I think I have seen this in the past but trying to recall what it was, is it happening all the time? Is it possible someone is pushing the front case button while the machine is locked, then that user logs off and the machine then logs off?

[robk]

Staff are telling me it happens all the time, just struggling to see if happen myself! Probably safer to say it happens frequently.

[phreak]

So it doesn't happen every single time right?

 

Does it only seem to happen for certain users? You say staff are reporting it all the time, but is there any common denominator with said staff and/or the machines they use? Same model or same AD groups?

 

Are you pushing out any Group policies that alter the setting “Change Start Menu power button”?

 

 

Perhaps create a little batch/cmd file that simply has in it "shutdown -l -f" and get them to try that instead of clicking the log off button on the start bar. See if that makes any difference?

[clareq]

I'm seeing similar. The machine logs off, sits for 30 minutes or so, then shuts down. We have no impero policies set to shut down machines during the day, and the power management gpo is set to turn off the monitor,not the PC. I can reproduce it.

[robk]

Interesting, have you updated Impero recently?

[clareq]

Yes, about a week ago

[robk]

Yes, about a week ago

Is that when the shutdown problem started for you?

 

We updated Impero last couple of weeks of the summer.

[clareq]

I'll confirm with the teacher, but we didn't have it reported before

[clareq]

The teacher tells me it has always happened (since September). I uninstalled Impero from my test machine, and it still shut down after 30-40 minutes.

[robk]

Ah thanks @clareq I was thinking impero but maybe not in this case. Will see if I can get someone to confirm it "always" happens on a machine and remove impero, just to be sure.

 

If it's not Impero I am not sure what else it could be though.

[clareq]

I'm about to look at my GPOs - may remove all power setting and see if it then happens

[mikkydoos]

I'm getting this also on a couple of Win7 x64 machines (one being the head teachers!).

 

No Impero here. Nothing in the logs - not even the shutdown event - just the startup logs.

 

User logs in then 10 mins later it shuts down, without needing to hit logoff.

 

No scheduled shutdown in task scheduler. All shutdown GPO's removed and confirmed gone in Rsop.msc.

 

A dodgy Windows update ?

Edited October 6, 2017 by mikkydoos

[clareq]

I was wrong - SCCM installed Impero for me

A machine excluded from the All workstations group, and with Impero uninstalled stayed on all weekend. Install Impero on it and it logs itself off consistantly after 30-40 minutes. I have no policies telling it to do so.

[robk]

Ah so Impero could well be a contributing factor at least!?

[clareq]

It could - I'm just testing to see if it's linked to group membership. If I remove my test machine from all my groups, so it's just in Entire network, it appears not to shut down (I've left it about 2 hours). I'm going to pop it into All PC's now, and see if that makes a difference.

[clareq]

And it immediately logged off.

[clareq]

Ohh - I think I'm getting somewhere - it's not all groups in Impero. In my case we have an "All PC's" group. Removing the test machine from that group and it seems to behave itself. I don't know yet whether it's simply the number of machines in the group, or just that particular group. Testing continues.