Windows Server 2012 R2 sometimes fails to boot (or shut down?) – stuck at spinner

bootwindowswindows-server-2012-r2

Our Windows Server 2012 R2 VMware virtual machines have scheduled tasks defined to reboot them weekly using shutdown.exe /r and some of these servers fail to restart some of the time. When I connect to the server via VMRC I see a screen like this:

I have to power cycle the server to get it to work again. The System event log doesn't contain any errors. The last messages before shutdown are:

The IKE and AuthIP IPsec Keying Modules service entered the stopped state.

The kernel power manager has initiated a shutdown transition.

After power-cycling there is a message like this:

The last shutdown's success status was false. The last boot's success status was false.

I tried enabling boot logging, but there are no logs at all for the failed boot in %SystemRoot%\ntbtlog.txt. So either the problem occurs before the first log entry is written or it's actually failing to shut down.

If I manually reboot the server, including by running shutdown /r from a command prompt this works. What else can I do to troubleshoot this?

Best Answer

I ended up doing this by taking a VMware snapshot of the machine while frozen and then converting the .VMSN file to a .DMP file using the vmss2core tool. I had to use the -W8 option to get it to read my .VMSN file (-W and -W9600 didn't work).

Related Solutions

Windows – Useful Command-line Commands on Windows

A little known one is

getmac

It shows the MAC address(es) of your network adapter(s).

Screenshot of running getmac from a Windows commandline window.

Windows Server – Restart/Shutdown History

The clearest most succinct answer I could find is:

How To See PC Startup And Shutdown History In Windows

which lists these event ids to monitor (quoted but edited and reformatted from article):

Event ID 6005 (alternate): “The event log service was started.” This is synonymous to system startup.
Event ID 6006 (alternate): “The event log service was stopped.” This is synonymous to system shutdown.
Event ID 6008 (alternate): "The previous system shutdown was unexpected." Records that the system started after it was not shut down properly.
Event ID 6009 (alternate): Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.
Event ID 6013: Displays the uptime of the computer. There is no TechNet page for this id.

Add to that a couple more from the Server Fault answers listed in my OP:

Event ID 1074 (alternate): "The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z." Indicates that an application or a user initiated a restart or shutdown.
Event ID 1076 (alternate): "The reason supplied by user X for the last unexpected shutdown of this computer is: Y." Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.

Did I miss any?

Related Topic