Logout \ Reboot...dunno

[thatrenowned]

The other day, I had to reboot one of our servers.
Anyway, it came back up alright...all files could be accessed etc.
However, three times where I've come to have a look at it, it has been at the CTRL+ALT+DEL stage. This means that its either logging itself out or rebooting.
I think its more likely to be logging out because I've had no complaints about file access problems, but other than that I can't prove it. Someone suggested to me that I look in event viewer but that turned up nothing (would it if the server was rebooting on its own?).

Does anyone have any suggestion as to why this is happening or how I can find out whether or not it is logging out\rebooting. Theres been no software updates or anything. Just the reboot.

In the morning, I'm going to try a virus scan but until then...

Thanks

 

[Zelandakh]

you got logon screen saver set up? sounds like its locking itself...

 

[thatrenowned]

Nah...not locking itself...its at the stage where you first logon. Normally it would go to a screen saver and lock.

It looks like its either just logged off or rebooted (and subsequently come back to the logon stage).

Thanks

 

[djhawthorn]

If it rebooted, you'd get at least two messages in the System Event Log saying "Windows NT 4.0 (Build 1381) Service Pack x" and "The Event Log Service has Started".

You can try turinging on auditing, and watch sucessful attempts for logon/off. That _might_ turn up something.

Have you got any third party applications that might log you out? MCSE NT4/W2K

 

[jtb]

any applications that log out users after periods of inactivity? time limits on the account you're using to log in?

no activity could also indicate someone was tampering with the logs files... is the server accessible via internet? are all with admin access reliable?

No sense being paranoid about security... after all, they really are out to get your server...

JTB
Solutions Architect
MCSE-NT4, MCP+I, MCP-W2K, CCNA, CCDA,
CTE, MCIWD, i-Net+, Network+
(MCSA, MCSE-W2K, MCIWA, SCSA, SCNA in progress)