Once upon a time I worked with another engineer that did not like to stay put in his chair we eventually caught on that he was using PSEXEC to remotely run commands to make weird stuff happen so he could leave the office. Not saying that’s what’s happening but u mentioned that a domain admin account was the culprit.
Joseph Carson [cid:image004.png@01D39A8D.D5945250]Technology Engieering Lead Riverside Casino & Golf Resort® | Grand Falls Casino Resort® | Rhythm City Casino® Office 319-648-0087 x1700 Email joseph.car...@riversidecasinoandresort.com.com<mailto:joseph.car...@riversidecasinoandresort.com.com> Join www.facebook.com/riversidecasino<http://www.facebook.com/riversidecasino> Web www.riversidecasinoandresort.com<http://www.facebook.com/riversidecasino> | www.grandfallscasinoresort.com<http://www.grandfallscasinoresort.com/> | www.rhythmcitycasino.com<http://www.rhythmcitycasino.com/> 24 Hour Technology Helpdesk<http://resortnet/RCGR/Technology/default.aspx> x1700, x3700, or x5700 From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of elsalvoz Sent: Wednesday, January 31, 2018 12:09 PM To: ntsysadm@lists.myitforum.com Subject: Re: [NTSysADM] Random reboots Win7 and 10 What are the events prior to the reboot event? Wild guess, WSUS or schedule tasks. On Jan 31, 2018 10:03 AM, "Sean Chapman" <schap...@coilcraft.com<mailto:schap...@coilcraft.com>> wrote: Hey all, Been going crazy today trying to find out why a lot of our PCs are rebooting on people with a 2 minute warning. It seems like it should be easy to track down but I cant find anything solid on whats causing it. This has happened for some users 2 days in a row now. Event viewer shows the following: The process wininit.exe (*PC_NAME*) has initiated the restart of computer *PC-NAME* on behalf of user *DOMAIN ADMIN ACCOUNT* for the following reason: Other (Planned) Reason Code: 0x80000000 Shutdown Type: restart Comment: On behalf of user *DOMAIN ADMIN ACCOUNT*, a shutdown/reboot request was made for the following reason: Other (Planned) The users are prompted with the following message [cid:image003.jpg@01D39A8D.D58BC6D0] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The information contained in this communication and all accompanying documents from Coilcraft may be confidential and/or legally privileged, and is intended only for the use of the recipient(s) named above. If you are not the intended recipient you are hereby notified that any review, disclosure, copying, distribution or the taking of any action in reliance on the contents of this transmitted information is strictly prohibited. If you have received this communication in error, please return it to the sender immediately and destroy the original message or accompanying materials and any copy thereof. If you have any questions concerning this message, please contact the sender.
