Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a workstation at work that is on a domain. Every night at the same time it is shutting down by itself. We have stepped through the normal list of items that might request a shutdown and have come up with nothing. What we have been able to determine is that if we leave the workstation unplugged from the network it remains on overnight as expected. There is absolutely nothing in the event logs that indicate what is requesting this shutdown and the only events that occur near the shutdown event (6006) is over 45 minutes prior. There are no scheduled events, automatic updates are off, system is running just the default MS services, etc.

This is a request from the network to shutdown. There is also no easy way to test what server might be sending this request because we have dozens that are on the network at any one time.

Diagnosing a problem that only occurs once a day is not so easy especially when it only occurs at 11:33 at night.

Is there a way to determine what is requesting a shutdown on a workstation? Is there a script/program to log when a shutdown request is made and what program/source is requesting it?

share|improve this question
@mjb Turn off and disable the service called RPC - remote procedure call. Disable and stop Remote Registry service. If this doesn't help try leaving the PC in the network but exclude it from domain - let it be as regular and remove domain administrator from the group Administrators. Install and start Wireshark. Configure it to listen on network interface and save the log to specified file of a big size - like 500 MB to make sure it will save all network packets that will be sent to this machine. – mnmnc Dec 19 '12 at 14:26
The turning off Services will prevent authorized users from shutting this PC down. taking it off of the domain and removing users from admin group will provide that shutdown is not being done by Admin or WMI call. The wireshark will show you if this is in fact being done over the network and what is the source IP address of this malicious action. – mnmnc Dec 19 '12 at 14:29

You must log in to answer this question.

Browse other questions tagged .