Server will shut down

[Fola]

Hi guys
I am a new folk here. I am managing a server which provides 24/7 access. During a visit to do a backup, I tried to unlock the system from its locked state. I got an alert that the server will shut down. I suspect this to be a virus or worm. the server is not connected to the internet. we use an external hard disk for backup operations. I can not afford to allow it shut down. what do you suggest I do to save the situation?

Fola

[DAldrich]

Do you have antivirus software on the machine? Was their an error associated with the shutdown message? Can you restore the backup to a new machine to diagnose the server issues?

[Tinus1959]

Originally Posted by Fola

Hi guys
I am a new folk here. I am managing a server which provides 24/7 access. During a visit to do a backup, I tried to unlock the system from its locked state. I got an alert that the server will shut down. I suspect this to be a virus or worm. the server is not connected to the internet. we use an external hard disk for backup operations. I can not afford to allow it shut down. what do you suggest I do to save the situation?

Fola

How could a virus or worm infect it when it is not connected to the internet and locked? You could try to manage the server using remote connections.

[Beoweolf]

Originally Posted by Fola

Hi guys
I am a new folk here. I am managing a server which provides 24/7 access. During a visit to do a backup, I tried to unlock the system from its locked state. I got an alert that the server will shut down. I suspect this to be a virus or worm. the server is not connected to the internet. we use an external hard disk for backup operations. I can not afford to allow it shut down. what do you suggest I do to save the situation?

Fola

First, start by checking event logs for reported errors. Based on how long the server has been running, what made you think of a Virus infection? It is just as likely that a Hardware error could force a shutdown.

Where do you store the external disc? Are both the disk and the server in protected, limited access areas?

If your situation requires 24/7/365, then you are attempting to play Russian Roulette with a Semi-automatic pistol...you lose even if there is only one round in the clip.

The only way I can see you recovering is installing a redundant, Identical server; clustered. Sooner or later you will need to do, detailed analysis of the running server to diagnose the problem - you'll full access to do that.

Follow what the logs tell you.

[supag33k]

I assume form the 24/7 access statement you made that this is possibly a remote access server via dialup or leased lines.

Now from your descriptions I would say that you have either a hardware fault of some kind or that you have a security access violation on this remote access device.

Note also that if the server is performing auto-updating of server patches from Microsoft it will give you this type of message also for a restart.

We need more information to be of further assistance at this point....and certainly I would be closely analysing the logs at this point.

[Fola]

Originally Posted by supag33k

I assume form the 24/7 access statement you made that this is possibly a remote access server via dialup or leased lines.

Now from your descriptions I would say that you have either a hardware fault of some kind or that you have a security access violation on this remote access device.

Note also that if the server is performing auto-updating of server patches from Microsoft it will give you this type of message also for a restart.

We need more information to be of further assistance at this point....and certainly I would be closely analysing the logs at this point.

Thanks folk
May be I should be clearer about the problem
I need your urgent contributions please. I manage a Windows server 2003. Recently when we wanted to do a backup job on it, the server was already locked and when it was unlocked instead to resume to desktop it presented the shutdown window and when the process was cancelled it went into locked state again.
my problem is how to make it resume to desktop for me to carry out appropriate troubleshooting.
Please note that the server is on a secluded network with no internet access. the server acts as a file server and other network computers accesses it. it has SQL server 2005 running on it which handles the database for an application software called LENEL. Lenel is a big security application software.
thanks folk.
Fola

[Triton.Deep]

Hrmms. That is interesting. I'm not sure this will work, but here's a thought. Log in using a different Admin account than the currently logged in user. If you do so, it will close the current log on session of whomever is logged on and present you with a ctrl-alt-delete prompt to allow you to log on normally again. If you don't have another admin account defined on that system, then you could either use the computer management console on a seperate system to create the account, or if it's part of an Active Directory domain, just add a new account to the domain admins or some other security group that would have admin access to that system.

See what I'm saying? Default behavior for a Windows 2003 machine when a different admin unlocks a locked station is to close the previous users session all together and allow you to login again. Basically, I'm saying doing that might give you a session reset and at least allow you to get to the desktop again.

I'm not sure what your trying to do on the system, but you can do almost anything remotely, so if that doesn't work maybe something through remote management would work. For example, use PSKill and PSlist from the Windows download site to murder any PS's that might be causing the shutdown sequence. I'd try the alternate log in idea first, but the process stuff might work to depending on what is going on with that system.

Thats two ideas. OHH..I forgot. you can also use a redirected Computer Management console from a different workstation to force a log off as well even to the point of forcing hung applications to close. That's another idea.

Here is the link to the PSTools suite:

http://technet.microsoft.com/en-us/s.../bb896649.aspx

I hope that helps.

J.

[Beoweolf]

Originally Posted by Fola

Thanks folk
May be I should be clearer about the problem
I need your urgent contributions please. I manage a Windows server 2003. Recently when we wanted to do a backup job on it, the server was already locked and when it was unlocked instead to resume to desktop it presented the shutdown window and when the process was cancelled it went into locked state again.
my problem is how to make it resume to desktop for me to carry out appropriate troubleshooting.
Please note that the server is on a secluded network with no internet access. the server acts as a file server and other network computers accesses it. it has SQL server 2005 running on it which handles the database for an application software called LENEL. Lenel is a big security application software.
thanks folk.
Fola

If the system needs to shut down the current session, I don't see how you can override it.

Check into EMS - Emergency Management service

It is available on server 2003. (SP1 + required)

If you have access to the computer, and it is configured correctly - it is (may be?) possible to attach a cross over cable to its NIC card or USB port, serial cable, then using another computer/laptop to start a session on that server.

[TOSH1]

Hi Fola

How did you get on?

Could you have accessed this via remote desktop from another pc?

TOSH1

[shankar-4]

I found an article on http://support.microsoft.com/kb/821287 and it says if the shutdown.exe is running at specific time the server won’t shutdown automatically.

Thanks

Shankar