Event log & server reboot

  • Thread starter Thread starter RQ
  • Start date Start date
R

RQ

Hi,
How to determine the server is rebooted from "Event Viewer" or somewhere
else in the server?
Suppose we can see some services starting log from Event Viewer. Could it be
no log show? Am I right?
Thanks,
Roger
 
In
RQ said:
Hi,
How to determine the server is rebooted from "Event Viewer" or
somewhere else in the server?

Look for Events 6009 and 6005. If the server was shutdown properly these two
events will be preceded by a 6006.
 
Thanks Kevin, I saw those logs, but not every times. Last week after
applied Microsoft security patches I asked night shift guy to reboot the
server at midnight. Next morning I checked Event Viewer and didn't find
those three logs. I was wondering that the server rebooted?
Roger
 
In
RQ said:
Thanks Kevin, I saw those logs, but not every times. Last week after
applied Microsoft security patches I asked night shift guy to reboot
the server at midnight. Next morning I checked Event Viewer and
didn't find those three logs. I was wondering that the server
rebooted?

If these weren't logged then the server didn't reboot.
Is the server Win2k or Win2k3?
What account was he logged on with?
 
It's a Windows 2K server with SP4 running IIS 5 on it. login is not an
administrator's account.
Thanks,
Roger
 
In
RQ said:
It's a Windows 2K server with SP4 running IIS 5 on it. login is not an
administrator's account.

The user probably does not have shutdown rights.
 
In
RQ said:
The login account is a power user who should have the rights to reboot
server.

Power user? Is this a domain controller? Member server?
Was the user logged on locally? Only Administrators can shut down the system
remotely by default.
 
I'm sorry, it's a local account because a key application (not run as a
service) from our vender in this web server needs a power user login.
The reboot should be processed by a night shift guy locally.
Thanks,
Roger
 
Back
Top