Problem with 2 users and random reboots

[Simon_Gibbs]

Hi guys

 

I've got two users that are having on going problems, and I've run out of ideas on what it may be. 2 Girls in year 8, I've asked their head of year and the child development team, and they all say they are excellent pupils, and from speaking to them they don't seem to be the type to muck around. BUT there machines crash, regularly, doesn't seem to matter what machine they are on, in what room. there computers will suddenly come up saying "windows is shutting down" and then shut-down.

 

I've created new users for them, with new profiles, new home areas, tried users and profiles with different names as well. Made them sit on different machines, still happens. I've checked that machines aren't over heating, that there is nothing at all in the event log, there is no error reports, they aren't kicking anything under the desk, the guys opposite them aren't doing anything to their machines.

 

I sat through a lesson with them this morning, for Rebecca, one of the two, it crashed just after she logged in at the start of the lesson, it went again as the teacher was talking, and I was watching, no one was touching mouse keyboard or computer, during some editing in publisher, then after a google search on IE. Molli the other girl crashed twice, once opening word, and the 2nd doing something on IE. This has been ongoing since September, and I'm

just totally out of ideas to what it could be.

[rob_f]

Hi Simon, are the machines actually crashing or shutting down gracefully? If they are "proper" shutdowns, what happens if for instance you were to deny them shutdown rights in a GPO? That may give you a clue if it is a process running as the user or system that is initiating the shutdown.

 

If you can catch the machine whilst its just started its mysterious shutdown, you may be able to glean information using pstools remotely such as pslist and psloggedon (to see if there's anything remotely interfering with it).

 

Anyway, just a few thoughts.... although I have a lingering feeling of foul play going on here

[Griffo]

Could they have downloaded something or put something on their home drives that may be running in the background once they have logged on?

[Simon_Gibbs]

Well, I've suspected foul play as well. But as I said, I sat with them all lesson today, and it shutdown with out anyone touching anything at all. My team are the only ones with rights to do remote shutdown, so it isn't any of us playing with it.

 

Their home drives are clear, I made completely new users, with new names, new home drive and new profiles.

 

The idea of disabling them shutdown rights via GPO is a good one though, I'll try and do that!

[K.C.Leblanc]

Are they using USB pens, could be something on there.

 

It's not somthing completly stupid like they're pushing the keyboards against the power buttons.

[Simon_Gibbs]

Neither had usb pens this morning, and the machines are towers, with the power buttons at the top.

[Spitfire]

We had this a few times and every time it has turned out to be a virus in their roaming profile. If possible give them a new clean profile

[Simon_Gibbs]

tried that as well, created them new users with different name to their originals, but still happened

[Griffo]

Have any of the documents or files they had before the new usenames on their old accounts been copied to the new account? Could they contain viruses?

[Simon_Gibbs]

We've scanned everything with Sophos, but no, their new accounts were empty, I'd put their old work on a cd for them, but they hadn't copied it across, as most of our machines that the students use don't have cdroms.

[Chris_Cook]

Have you tried their accounts without the students being present? just to eliminate the users themselves...

[Simon_Gibbs]

Disabling their ability to shut down machines completely via GP seems to have fixed it, still no idea why it was happening.. but it doesn't any more! thanks

[Reaper]

Let us know when you manage to find out what was causing it

[penfold]

Have you tried to disable the Automatic Restart? Maybe if you set it to be disabled it will show you the errors that it causing the clients to shut down?

 

Go into the system properties and select the Advanced tab and then click Settings in the Startup and Recovery section. In System Failure section, clear the checkbox next to Automatically Restart.

 

Edit: I have had a similar problem but was with random accounts. It turned out it was something to do with IE, but there was no error logs until I disabled auto restart.

[Simon_Gibbs]

it wasn't a hard reset, it came up as a proper windows shut-down, like if someone had hit the power button, or told windows to shut-down properly, but I'd spent a whole lesson watching them, seen it happen a few times, and neither of them touched the power button or went to the shut-down dialogue. but as I said, its fixed, I'll try and have a look at what was causing it, but not high on my list now, its this blasted Arc GIS digital world software, company is very helpful, but its still making me pull my hair out, each time I've nearly got it working, something else goes wrong with it. But very close to it working, just need to sort out maps.. hopefully