I think SCCM is shutting down my W7 clients randomly, how can I tell?

[ben604]

Hello,

 

We're running SCCM 2012, configured using the guides on this very website, incredibly helpful!

We've started seeing random-ish restarts of our W7 clients. After 3.30pm every night, at random intervals, a couple of our machines, without warning, close down all applications and reboot. There are no notifications and no opportunity to postpone (much to our teacher's horror as the machine shuts down mid-email/important work)

 

Here's an entry from the client event viewer:

The process C:\Windows\system32\wbem\wmiprvse.exe (ADM-CMA-001) has initiated the restart of computer ADM-CMA-001 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070015
 Shutdown Type: restart

 

Could anyone point me in the right direction as to where to look for something that's triggering the restarts?

 

Any help would be very much apprectiated!

[GarthMJ]

The Execmgr.log would be the first place that I would look for a CM12 issue.

 

Do you have an silent Adverts? What do they do?

 

Have you create Maintenance windows for your PCs? This will prevent rebooting outside of those windows.

[ben604]

Thanks for that Garth,

Here's the last couple of days worth of Execmgr.log:

 

CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event	execmgr	04/03/2013 04:00:05	1112 (0x0458)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : START Event	execmgr	04/03/2013 09:00:04	4676 (0x1244)
CExecutionRequestManager::OnServiceWindowEvent for START	execmgr	04/03/2013 09:00:04	4676 (0x1244)
Auto Install is set to false. Do Nothing.	execmgr	04/03/2013 09:00:04	4676 (0x1244)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : START Event	execmgr	04/03/2013 22:00:03	3724 (0x0E8C)
CExecutionRequestManager::OnServiceWindowEvent for START	execmgr	04/03/2013 22:00:03	3724 (0x0E8C)
Auto Install is set to false. Do Nothing.	execmgr	04/03/2013 22:00:04	3724 (0x0E8C)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event	execmgr	05/03/2013 04:00:02	7336 (0x1CA8)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event	execmgr	05/03/2013 05:00:02	9464 (0x24F8)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : START Event	execmgr	05/03/2013 09:00:03	8440 (0x20F8)
CExecutionRequestManager::OnServiceWindowEvent for START	execmgr	05/03/2013 09:00:03	8440 (0x20F8)
Auto Install is set to false. Do Nothing.	execmgr	05/03/2013 09:00:03	8440 (0x20F8)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : START Event	execmgr	05/03/2013 22:00:03	8292 (0x2064)
CExecutionRequestManager::OnServiceWindowEvent for START	execmgr	05/03/2013 22:00:03	8292 (0x2064)
Auto Install is set to false. Do Nothing.	execmgr	05/03/2013 22:00:03	8292 (0x2064)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event	execmgr	06/03/2013 04:00:02	10484 (0x28F4)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event	execmgr	06/03/2013 05:00:03	8292 (0x2064)
CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : START Event	execmgr	06/03/2013 09:00:03	8440 (0x20F8)
CExecutionRequestManager::OnServiceWindowEvent for START	execmgr	06/03/2013 09:00:03	8440 (0x20F8)
Auto Install is set to false. Do Nothing.	execmgr	06/03/2013 09:00:03	8440 (0x20F8)

 

It doesn't give much away..!

 

I've got FEP2012 running, deployments for FEP, Flash and WSUS updates. I've reconfigured the maintenance windows to run from 17.30 - 23.30, but they're still restarting...

[GarthMJ]

I don't see anything in that log file that indicated CM12 is forcing the reboot of the WS.

 

Have you confirmed that no SU have been applied to these WS?

Have you confirm that the time zone settings are correct?

Are the MW setup to use UTC?

Are you sure that only one MW applies to these WS?

What does the Event Viewer say? Aka are there any other items within it that might lead to what is going on?

What about schedule tasks?

[MDMoore313]

I'm also having the same issue. My machine, and also another user's machine. I have the same event log entry as Ben604, but also in the Application event log there is an entry from WSH event id 4 that simply says 'Initiated scripted REBOOT'. That phrase turns up 0 results on Google when typed verbatim. The computer that initiated the reboot was my SCCM site server.

 

my execmgr.log only has one entry for that time frame and it simply says 'The user has logged off.' I will dig through the other logs and see what I can find.

[MDMoore313]

I found this in the SoftwareCenterSystemTasks.log:

 

CSoftwareCenterStartUpTask:: Start Software Center System shutdown task.

[GarthMJ]

@MDMoore313 Is that for the same time frame?? it si unclear from your log snip-it

[ben604]

Hello, I think I had a sneaky maintenance window on a collection which went under my radar. I've been through with a fine tooth comb and my problem seems to have disappeared. Thanks for the help Garth!

[MDMoore313]

@Garth, yes, same time frame, however the event log entry came first, not the SystemTasks.log entry, so at this point I will be looking server side to see what the issue may be. We don't do maintenance windows at the moment (I'm still fighting that battle), and reboots are suppressed on updates and package deployments.