Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We have a workstation at work that is on a domain. Every night at the same time it is shutting down by itself. We have stepped through the normal list of items that might request a shutdown and have come up with nothing. What we have been able to determine is that if we leave the workstation unplugged from the network it remains on overnight as expected. There is absolutely nothing in the event logs that indicate what is requesting this shutdown and the only events that occur near the shutdown event (6006) is over 45 minutes prior. There are no scheduled events, automatic updates are off, system is running just the default MS services, etc.

This is a request from the network to shutdown. There is also no easy way to test what server might be sending this request because we have dozens that are on the network at any one time.

Diagnosing a problem that only occurs once a day is not so easy especially when it only occurs at 11:33 at night.

Is there a way to determine what is requesting a shutdown on a workstation? Is there a script/program to log when a shutdown request is made and what program/source is requesting it?

share|improve this question
    
@mjb Turn off and disable the service called RPC - remote procedure call. Disable and stop Remote Registry service. If this doesn't help try leaving the PC in the network but exclude it from domain - let it be as regular and remove domain administrator from the group Administrators. Install and start Wireshark. Configure it to listen on network interface and save the log to specified file of a big size - like 500 MB to make sure it will save all network packets that will be sent to this machine. –  mnmnc Dec 19 '12 at 14:26
    
The turning off Services will prevent authorized users from shutting this PC down. taking it off of the domain and removing users from admin group will provide that shutdown is not being done by Admin or WMI call. The wireshark will show you if this is in fact being done over the network and what is the source IP address of this malicious action. –  mnmnc Dec 19 '12 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.