I need help with a very baffling and infuriating issue I am having on a users PC.
This user has an AD account they have logged with for several months. all of a sudden recently the PC has started shutting down as though called by another app or process. there is no warning and no consistency as to how long it will be before it does.
They run 4 apps, email outlook 2007, an in house database app, and 2 web based applications. The PC's run WinXP SP3 with all the latest updates including Java, etc.
This is the same application the other 100 people run and has done from they started. The strange thing is it only seems to be affecting her and even more peculiar it happens , no matter what PC she logs on to. I have tried disabling anti-virus.windows updates, only the basic services are running and still it happens, even when she has not loaded any apps
I have had her log in with 2 different user accounts and the result is the same. nothing has changed in her applications. I thought I had found the problem with a windows update and so declined and disabled the update.
I have checked through the event viewer and every log I can think of but cannot find which application or processed called for the shutdown.I tried adding a vbscript and batch file as a shutdown script to abort the shutdown but by the time the script is called it is too late to abort.
Is there any way to either intercept the shutdown without having to write a program to use the WM_QUERYCLOSESESSION hook? or find which process or application called for the shutdown.
Any ideas would be helpful, this one has me stumped.
Check her GPs. We used to have one set on the default OU when creating new accounts that would log it off after a minutes time. So the Tech would have to manually move it to the correct OU etc...
chamezzzz - it has happened on each PC that she has logged onto, we are up to 3 so far.
jsclmedave -- She would be using the same GP as the rest of the guys and has been since she started. there have been no changes to the GP's recently. we don't currently use roaming profiles.
I have got here on the original PC, I deleted all the profiles including hers removed it and re-added it to the domain. it has been stable all day. although it has been like this before.