Workstations rebooting on a Windows 2000 network

[td51]

I have a Windows 2000 network (workstations and server) that has just started rebooting the workstations during the day while in use for no apparent reason. There has been no changes to this network for more then two months. All hardware is fine (including power supplies). The server also has Windows Terminal Services running and all users have roaming profiles set up. No part of this network is connected to the out side world. A user can be working in any program when the system will reboot.
This network has been up and running for more then a year with no problems. Any ideas on what might be causing this problem?

 

[philote]

I know you said that no part of your network is connected to the outside world, but have you checked for viruses?

 

[td51]

All of the systems are running Nortons. The one workstation I had to format and reload because missing or corrupted files within Windows 2000 Pro and Office XP. As soon as I reconnected this system back on to the network and logged on with the user's name, the system rebooted once the desktop came up. As long as I was logged on as Administrator of the workstation it did not reboot. I have brought this workstation back to my office and attached it to a test server setup the same way the customer's is and it has not rebooted here also.

 

[philote]

I still wouldn't rule out a virus. Since they're not connected to the internet, how are they getting updates for Norton?

 

[td51]

I manaully update the systems from CD off of my system at the office. I will run a total scan just to make sure.

 

[RedTech]

They just reboot? No messages, no countdown? What is the Event Viewer reporting?

----------------------
"Hi, I'm a sig virus. Please add me to the end of your sig and help me take over the world."

 

[kosekjm]

Hi there,

I would have to agree that this sounds virus like. I believe that the Blaster virus exhibited this exact type of behavior. Though it is odd that you say only the workstations are rebooting and not the servers.

Is it always the same user name that causes the machine to reboot or is any of the users? As RedTech stated, is there anything in the event log in regards to the shutdowns? Is there other software installed on this netowrk (more specifically Network management software like Tivoli, SMS, etc)?

Definitely sounds funny though.

kosekjm