Hey guys,

Ever seen a SBS2003 Server constantly reboot after getting a new mainboard? Now, it is exact same mainboard, even revision number, slightly newer Bios, and when booting in normal mode, gets to the logon screen. Within 3-5 minutes it says shutting down, as if a user has done it, not a blue screen / crash. Safe mode / last known good boots fine, this is only normal mode.

Eventlog has bugger all apart from "dsrestore failed to connect to local sam" but as far as I can find that is unrelated (yes to be fixed, but later).

No Hal errors, no blue screens, just shutting down... Ever seen this before? I am about to take a snapshot and restore the system partition, failing that a repair install over the top. Just thought I'd check here first.

Cheers

how about you downgrade the bios? what board? server? ...

yeah thought about it, will do shortly. Its a cheapy asus server, Mid tower. Its actually a mate I help out time to time..

It's clearly the RAM, CPU or new motherboard?

RA the parts IMO

clearly

im assuming your uptodate with sp's? and its not sasser?

http://www.pchell.com/virus/sasser.shtml

looked in event viewer to see whats actually happening?

:loop
shutdown -a
goto loop


Seriously though, I take it then you can get past the login screen, i.e. actually get to a desktop? Is the shutdown message the countdown type (like when svchost for RPC dies) or just the thin "Windows is shutting down..." dialog with the windows bitmap?

Personally I'd run msconfig/autoruns/hijackthis to disable any unnecessary services, startup/logon programs/scripts etc. until normal mode == safe mode, and if that works binary search through the stuff turned off to figure out which one is causing the problem. Or, if it was something really nasty, write a hack to hook the shutdown API, wherever that is (or just use the above .cmd to abort the shutdown and do logging to see what is going on: filemon,regmon,procexp, etc.)

hazaa, well that was a weird ass problem. Turns out the fella who looks after the server set it to autologon (yes as administrator, any joe blow could walk by and access all data), the admin profile was corrupt and the UPS monitoring service was set to run as administrator.

Upon bootup, the Server would login as admin, the UPS service tried to start but with the shagged profile, could not, the UPS software took this as oh crap, the UPS is not responding and must be out of battery, shutdown server.

Crazy.....

p.s. It was a generic crap box UPS.

haha yea, it was clearly the RAM, CPU or new motherboard

argh you never said anything about UPS :P amusing none the less

clearly it was bios.