Randomly shutting down

[Lesley_tech]

Hi there people.. Me again

 

I have noticed computers across the school are randomly just switching them selves off or restarting. i can't find anything in the logs about why they are. it just seems to be attacking certain rooms, not random computers . Please could someone help me =-)

[superfletch]

You sure it is random (ie - you've actually seen it happening) and not just that kids have been reporting it.

 

If you've seen it happening)

 

Have you recently put out a new image to most of the machines you believe to be affected?

 

If you haven't and it is just a reported problem)

 

Is it anything to do with the p[ower management settings (within BIOS not windows) of the PC's themselves?

 

Just some ideas to be looking at anyway - don't forget it is Friday the 13th, could you have a techie friend who is playing a practical joke?

 

EDIT - This post assumes you've just noticed this!! What FN-Greatermanchester has just added would make more sense if it is an ongoing problem.

Edited June 13, 2008 by superfletch

[FN-GM]

They are probably overheating. I would check the airflow and possibly put an extra fan on the back of the case.

[Joedetic]

We have this as a heat issue. Some of them just refuse to play DVDs Other just shut off.

 

We've got air con in all the e-learning rooms now (appart from one new one).

[laserblazer]

I immediately thought overheating or psu. I don't know if it is likely but could something like a voltage surge affect the power supplies, some worse than others. If I have a machine that is constantly resetting, the first thing I check is the psu and that normally is the problem.

[Lesley_tech]

Hi.. Its not just one computer its about 5 all at once

[laserblazer]

Hi.. Its not just one computer its about 5 all at once

 

Which is why I wondered if some external power glitch might have affected the power supplies. Try taking the psu out of a good machine and trying that.

 

Try running them without the case, blow desk fan on it.

[SYNACK]

If it does turn out to be heat based you may want to clean out the heat sinks on the machines, I did a write up (all be it themed) of the methods to clean these out.

http://www.edugeek.net/forums/blogs/synack/56-weapons-war-dust-bunny-epidemic.html

 

It could also be an issue with the points or phase that those specific computers are on, you might want to try moving one of the pcs to a different point and seeing if it still affects it.

[Lesley_tech]

I have found out what it is.

 

Remote shutdown . . How does this work

[Joedetic]

shutdown -s -m \\machinename

 

From the CLI.

[FN-GM]

or on the command you can do

 

shutdown -i

 

have one of the kids managed to access the command prompt?

[SteveT]

MS Updates???

[Lesley_tech]

Hm Will have to look into this .. Thanks guys

[JP_Freeman]

Hello, my name is JP Freeman and I am an ICT technichan at UCT (University of Cape Town).

 

I recently had this same problem with some of my computers, we have been told by some students and teachers, because of this I have decided to investigate this and have found a few students to be using it.

 

I have also found students accessing Task Manager, Regedit and the Command Prompt, is there anything I can do to stop them without disabling their accounts? If they got past our Ranger and group policies is there a way to stop them?

[Hightower]

Why did they get past group policies - I would double check the settings they have because this is a big no no. Either something isn't working right or your GPO's are too relaxed

[JP_Freeman]

Ok I will check, but it also seems that one of them has a batch file on thier network space. I have deleted this as it unlocks Task Manager.

 

Is there a way I can stop them running these files?

 

If so is there a way I can make sure they can never access it again?

[YorkshireTechie]

i had a similar problem with command prompt and net send a few months ago, if i remember correctly we disabled the net send messenger service and made sure the firewall was enabled on the systems we had problems with.

 

i think there are settings in the software restriction policy for cmd.exe and .bat file types that can stop the students using them but be careful because if your using batch files for anything like connecting printers it also stops them working as well.

 

hope this helps

[JP_Freeman]

Thanks.

 

I shall look into this tommorow.

[Busybub]

I have also found students accessing Task Manager, Regedit and the Command Prompt, is there anything I can do to stop them without disabling their accounts? If they got past our Ranger and group policies is there a way to stop them?

 

 

Could try from another angle and deny the executables in a policy under User Config/Admin templates/System/Don't run specified Windows applications:

 

taskmgr.exe, regedt.exe/regedt32.exe, and cmd.exe

[Michael]

The policies you're looking for are these:

 

User Config > Admin Templates > System

 

Prevent access to the command prompt Set the policy to Enabled and No

 

-----------------------------------------

 

User Config > Admin Templates > System > Ctrl+Alt+Del options

 

Remove Task Manager Set to Enabled

 

-----------------------------------------

 

User Config > Admin Templates > System

 

Don't run specified Windows applications - Enabled - Add Notepad.exe

 

-----------------------------------------

 

User Config > Admin Templates > Start Menu and Taskbar

 

Remove Run menu from Start Menu - Enabled

 

-----------------------------------------

 

User Config > Admin Templates > Windows Components > Windows Explorer

 

Removes the Folder Options menu item from the Tools menu - Enabled This will prevent users enabling file extensions, so they cannot change .txt files into .bat files for example!

 

This should do the trick

[Hightower]

i think there are settings in the software restriction policy for cmd.exe and .bat file types that can stop the students using them but be careful because if your using batch files for anything like connecting printers it also stops them working as well.

 

This is what you need to take a look at JP, but does it even stop the printer scripts running if you have them set up to run as the SYSTEM account? I'm sure you can block exe's and bat's for the user type and have the ones you want to run set up to use the SYSTEM.