Windows Server 2012 initiates shutdown/unplanned/unattended Reason Code 0x0500ff

we have brand new dell server installed on 9/1 of year , since twice has performed shutdown reason code 0x500ff. have searched web answers on , found nothing can confirmed or relevant in case. server specs follows: 

poweredge t110 ii/intel xeon e3-1240v2 3.40 ghz, 8m cache, turbo, quad core/8t (69w)/h200 cbl, poweredge t110ii 3.5 hard drives/perc h200 adapter raid controller/windows server 2012 r2 standard

the 2 times has occurred have same exact event entries leading , after shutdown. server dhcp, active directory handful of users , hosts 2 applications.  both occurrences happened on weekend when there no 1 in office.  i had disabled shutdown on power button press (just in case) , 1 can log on server. have checked virus , malware both negative. event log follows:

log name:      system
source:        user32
date:          11/16/2015 6:33:34 am
event id:      1074
task category: none
level:         information
keywords:      classic
user:          s-1-5-21-3165303471-3447515403-729963348-500
computer:  
description:
process c:\windows\system32\winlogon.exe (<server>) has initiated power off of computer <server> on behalf of user <domain>\administrator following reason: no title reason found
 reason code: 0x500ff
 shutdown type: power off
 comment: 
event xml:
<event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <system>
    <provider name="user32" guid="{b0aa8734-56f7-41cc-b2f4-de228e98b946}" eventsourcename="user32" />
    <eventid qualifiers="32768">1074</eventid>
    <version>0</version>
    <level>4</level>
    <task>0</task>
    <opcode>0</opcode>
    <keywords>0x8080000000000000</keywords>
    <timecreated systemtime="2015-11-16t12:33:34.215548100z" />
    <eventrecordid>15246</eventrecordid>
    <correlation />
    <execution processid="436" threadid="484" />
    <channel>system</channel>
    <computer>server.domain</computer>
    <security userid="s-1-5-21-3165303471-3447515403-729963348-500" />
  </system>
  <eventdata>
    <data name="param1">c:\windows\system32\winlogon.exe (<server>)</data>
    <data name="param2"><server></data>
    <data name="param3">no title reason found</data>
    <data name="param4">0x500ff</data>
    <data name="param5">power off</data>
    <data name="param6">
    </data>
    <data name="param7"><server>\administrator</data>
  </eventdata>
</event>

a few people issue have been instructed replace power supply. have no way confirm or not issue given instances month apart. there no other errors or warning during these times. also, there no hardware entries @ all. also, windows update not culprit either them manually. also, have tried decipher kernel power entry previous shutdown follows:

 

log name:      system
source:        microsoft-windows-kernel-power
date:          11/16/2015 6:33:30 am
event id:      109
task category: (103)
level:         information
keywords:      (4)
user:          system
computer:      uhserver.ultimatehealth.com
description:
kernel power manager has initiated shutdown transition.
event xml:
<event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <system>
    <provider name="microsoft-windows-kernel-power" guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />
    <eventid>109</eventid>
    <version>0</version>
    <level>4</level>
    <task>103</task>
    <opcode>0</opcode>
    <keywords>0x8000000000000004</keywords>
    <timecreated systemtime="2015-11-16t12:33:30.667209100z" />
    <eventrecordid>15244</eventrecordid>
    <correlation />
    <execution processid="4" threadid="4720" />
    <channel>system</channel>
    <computer>uhserver.ultimatehealth.com</computer>
    <security userid="s-1-5-18" />
  </system>
  <eventdata>
    <data name="shutdownactiontype">6</data>
    <data name="shutdowneventcode">32</data>
    <data name="shutdownreason">2</data>
  </eventdata>
</event>

i cannot life of me find table tells me codes mean for shutdownactiontype, shutdowneventcode, or shutdownreason. don't know if relevant think given codes change depending on type of shutdown initiated.

any appreciated, thank you.

 i interested in finding code definitions 109 event kernel power manager.

i'd try them on here.

https://social.msdn.microsoft.com/forums/windowsdesktop/en-us/home?forum=perfmon%2cwindowsgeneraldevelopmentissues%2cwindbg&filter=alltypes&sort=lastpostdesc

 

 

 

 

---

regards, dave patrick ....
microsoft certified professional
microsoft mvp [windows]

disclaimer: posting provided "as is" no warranties or guarantees , , confers no rights.

Windows Server  >  Windows Server 2012 General