2003 Server shuts down after logon

**kkingston** · February 17th, 2006, 12:07 PM

I am running a win23k server, relatively new machine, couple of months. It is the dhcp server, dns server, and holds gc. It replicates with 2 other servers that are in other locations. We had a power spike the other day and I thought my ups politely shut down the server but upon reboot it just hung on detecting network connections. It would boot into safe mode but not normal. In the event viewer I had some scecli errors which pointed to the security database. I thought I would do a restore of the c drive and system state. Did that, all came back but then what probably happened is that my other dc's replicated the bad AD back. I decided to reboot to test if it would still work and it got past the detecting network connections phase but as soon as I logged in as admin, the machine shut down! This occurred even when I booted into recovery console... it runs fine if I boot into safe mode or run msconfig and boot into diagnostic mode.
I can't find anything on the internet with regard to this weird behavior....
Thanks.

**PBase001** · February 17th, 2006, 01:52 PM

What does Event Viewer logs tell you? No errors?

**kkingston** · February 17th, 2006, 04:23 PM

There were 4 events 486,1202,413 and 1005 which I could only find out that it may involve security account database and a abrupt power outage. I got so flustered that I didn't see a ups service notification that it was shutting down my system...
Anyway, started a clean boot seqence and it indeed pointed to a service shutting me down. My dhcp also disappeared..
Anyway, disabled the ups service from safe mode and that took care of the shutdown. Don't have a clue how that happened. Reinstalled dhcp and configured it. The above four events stemmed from a rogue edb00009.log file in c:\windows\security\database which wouldn't allow the security accounts manager to write to the log. Once that was renamed all events disappeared.