Windows Essentials Server intermittently shuts down

Question

We have two servers currently set up - both are Windows Essentials, (the second is R2). Currently we have no fully configured the second server so that it doesn't clash with the first (we can't have two Domain servers; and essentials can only run one Domain), and all are connected to the same network.

The issue is that the second server intermittently shuts down/turns off. It can happen at any time - sometimes overnight, sometimes first thing in the morning, sometimes halfway through the day.

• I have checked the Power Settings: it is using High Performance, with no settings about shutting down. There was one setting - "Turn off the Hard Disk after X Minutes": currently set to 0. This does not seem to affect anything, as I have revisited the Server to do work on it every 2 hours or so, without having to turn it back on again. This morning we had one user accessing it, and it shut down while they were using it.
• It does not suffer from any overheating issues - the cooling is working fine and it is in a well airconditioned room; it never emits any heat.
• There are no issues with shutting down/restarting manually.
• There are no issues with startup.
• The server Dashboard does not have anything about shutdown procedures (that I have seen)

Does anyone know what might be causing this unexpected shutdown/turn off?

Here is the relevant event log:

    26/11/2015 3:28:26

The kernel power manager has initiated a shutdown transition.

- System 

  - Provider 

   [ Name]  Microsoft-Windows-Kernel-Power 
   [ Guid]  {331C3B3A-2005-44C2-AC5E-77220C37D6B4} 

   EventID 109 

   Version 0 

   Level 4 

   Task 103 

   Opcode 0 

   Keywords 0x8000000000000004 

  - TimeCreated 

   [ SystemTime]  2015-11-26T05:28:26.966536700Z 

   EventRecordID 49829 

   Correlation 

  - Execution 

   [ ProcessID]  460 
   [ ThreadID]  464 

   Channel System 

   Computer CRESVR02.CREANDSEL.local 

   Security 


- EventData 

  ShutdownActionType 5 
  ShutdownEventCode 0 
  ShutdownReason 5 

---

Edit: After a bit more research, this seems to be happening on a regular basis - every Thursday, we have to come in and turn on the Server. This could be related to updates, however:

• Updates are set to "Automatically download, but let me choose when to install them"
• The last check for updates was on Wednesday night, at ~6pm. The shutdown occurred Thursday morning at ~3am.

Answer 1

Sorry that I could provide only a partial answer. I've hit the same problem with a Windows 7 machine, and believe I've found the reason for the reboot. In my eventlog, also every few days the same message appears, down to ShutdownActionType 5, ShutdownEventCode 0 and ShutdownReason 5.

At the same dates, WindowsUpdate.log shows:

[... WU installs latest MSSE (MS Security Essentials) update... ]
2020-04-15  00:18:26:034     768    c78 AU  Launched new AU client for directive 'Install Approval', session id = 0x3
2020-04-15  00:18:26:037    8132    1fc8    Misc    ===========  Logging initialized (build: 7.6.7601.24436, tz: +0200)  ===========
2020-04-15  00:18:26:038    8132    1fc8    Misc      = Process: C:\Windows\system32\wuauclt.exe
2020-04-15  00:18:26:037    8132    1fc8    AUClnt  Launched Client UI process
2020-04-15  00:18:26:049    8132    1fc8    Misc    ===========  Logging initialized (build: 7.6.7601.24436, tz: +0200)  ===========
2020-04-15  00:18:26:049    8132    1fc8    Misc      = Process: C:\Windows\system32\wuauclt.exe
2020-04-15  00:18:26:049    8132    1fc8    Misc      = Module: C:\Windows\system32\wucltux.dll
2020-04-15  00:18:26:049    8132    1fc8    CltUI   AU client got new directive = 'Install Approval', serviceId = {9482F4B4-E343-43B6-B170-9A65BC822C77}, return = 0
2020-04-15  00:18:48:958     768    c78 AU  AU received handle event
2020-04-15  00:18:48:958     768    c78 AU  AU setting pending client directive to 'Install Approval'
2020-04-15  00:18:57:201     768    c78 AU  Initiating Install-at-shutdown
2020-04-15  00:18:57:201     768    c78 Shutdwn user declined update at shutdown
2020-04-15  00:18:57:201     768    c78 AU  Successfully wrote event for AU health state:0
2020-04-15  00:18:57:201     768    c78 AU  AU initiates service shutdown
2020-04-15  00:18:57:201     768    c78 AU  ###########  AU: Uninitializing Automatic Updates  ###########
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:597     768    c78 Agent   Sending shutdown notification to client
2020-04-15  00:18:57:630     768    c78 Service *********
2020-04-15  00:18:57:630     768    c78 Service **  END  **  Service: Service exit [Exit code = 0x240001]
2020-04-15  00:18:57:630     768    c78 Service *************

As I interpret it, Windows Update sends notification to the user for shutdown. The "user" wasn't present at the time and so it registers as declined; in spite of this, windows seems to force the reboot, however.

Solution I'm trying as of now: Preventing automatic reboots by group policy. I'll have to manually reboot periodically (e.g. after patch day) however.

• Open gpedit.msc
• Navigate to
  1. Local Computer Policy
  2. Computer Configuration
  3. Administrative Templates
  4. Windows Components
  5. Windows Update
• Enable "No auto-restart for scheduled Automatic Updates installations"