Workstation receiveing a restart command from another workstation.

[QuaziBee]

I have two workstations on site with drives mapped to each other.
BFG9352BH and
BFG9352P1

Every morning at 6:32am the BFG9352P1 machine logs a 1074 event with the following information.

The process wininit.exe (BFG9352BH) has initiated the restart of computer BFG9352P1 on behalf of user BFG9352P1\support for the following reason: No title for this reason could be found
Reason Code 0x800000ff
Shutdown Type: restart
Comment: Temporary Windows Shutdown in progress - Will restart automatically...

There is no user interaction, no scheduled tasks, and I can't find any services written to send a restart command. When the even occurs, there is no user logged into the sending PC; however, the support account is always logged into the receiving PC.

Since no user is logged into the sending PC I was leaning towards a rogue service that some knuckle-head implemented for some reason but I can't find anything different when comparing to other sites with identical setup. On the other hand, if no user is logged in to the sending PC then no drive is mapped and therefore no admin privileges are given as they are different accounts. One is on a domain and the other isn't.

Is there a way to schedule a script (like vbs) to run on a PC with no user logged in currently?

 

[alaa_ecv_tc]

Do you want to solve the problem or know if there is a way to run script without user log in ?

Change the time on the sending pc to near before 6:32am and see if it is really sending from there !
If the command sent run this command at the receiving pc : shutdown -a .. this must abort the shutdown counter .

Antivirus programs runs with system without logging in .. so can do any virus or program or script ! right ?
Here is a list of startup locations in windows :
Windows Program Automatic Startup Locations

The shutdown code means it is planned so there is no hardware errors :
System Shutdown Reason Codes (Windows)


This what I can help