PROBLEMS:Well, win2k is an alrenative, more or less

[mgerics]

I have 2 win2k servers at work, one compaq and one dell, different ages about a year apart, both > 5 years old
.
For some reason, one or both at times will reboot, leaving no entries in event viewer, save that on reboot, both will register "error 6008: The previous shutdown was unexpected..."
It's as if someone yanked the power cords and they restarted.

Was told it was power related, but there is a third server (NT) on the *same* power circuit that NEVER crashes. Put one of the servers on a battery backup - still happening at random, no visible cause/indication/rhyme or reason...

Did noticed that twice I rebooted the switches and hubs we have here (3Coms) , and the server that is the dhcp and dns server rebooted as soon as I powered the switches back up.

Any ideas? This is getting a bit aggravating.

Thanks in advance.

[a1200]

I had a dodgy Network card in a Win2k server years ago, that caused a similar problem. Try disabling/removing the NIC and replacing it with another.

[Ilwrath]

If you don't need the functionality, disabling Wake-on-Lan in the BIOS might be a good idea.  Sometimes it can screw up.
Honestly, it does sound like a power issue, though.  Maybe the old power supplies in the server?

[odin]

OT, but you are aware that M$ ended support for W2k Server in July? Although we also still have several W2k machines running production, we're quickly phasing them out or upgrading them to W2k3.

[outlawal2]

See below:  Google is your friend...  Took about 12 seconds
http://support.microsoft.com/kb/326564

[jj]

Is it me or does that not fix the problem of the machine re-starting in the first place ?

[outlawal2]

Is it me or does that not fix the problem of the machine re-starting in the first place ?

The article states what the meaning of the error is and why it shows up... (Please note that it specifically points to the fact that the machine was restarted on purpose, not a spurious issue.  Something is purposely causing the machines to restart and since the third machine is NOT rebooting it is not the electrical circuit they are connected to...

Since there are 2 machines exhibiting this behavior it is very doubtful that it is a hardware issue as the cause would have to effect both machines at the same time... VERY doubtful. (Besides, as already stated this particular error means that a piece of software purposely caused the reboot so it can't be hardware.)

 So my suggestion is take a good long look at the software being run on these boxes and more to the point.. WHO has rights to them as I would guess you have an INDIVIDUAL that is rebooting these boxes...  Or a program that is doing it on it's own...

Either way, it isn't hardware it is a software and rights issue.  (Rights because someone that shouldn't be is rebooting your boxes)

[Boudicca]

check for conficker polling, 2k servers are DOS attacked to BSOD (IRQ less than or equal to) to load the conficker worm at next boot. (They still crash even if protected) (Most people now have their servers patched i.e SP4 + SMB patch), Check the security logs for failed authentications as will show the polling device/pc or server.  Make sure your Av is upto date and scanning. Check scheduled tasks for spurious AT events.

then again....I probably wrong