Which Service/Process Keeps Restarting My PC Daily?

[LanceX]

The computers we use at my job run Windows XP Professional. The computers restart at exactly the same time each morning at 5am. What I'm trying to do is learn as much as possible about what is causing the restart so that I can prevent it.

There have been times where I'll be working on a very important project, the computer will restart, and I will lose significant progress. It isn't the sort of work where you can just hit "Save" and continue where you left off after the restart.

If there is a process running that is causing the restart, I want to be able to identify it so that I can "End" it when necessary. If the restart is being caused by a Windows service then I want to be able to identify it so I can "Stop" and/or "Disable" it when necessary.

I will tell you what steps I've taken and what I've learned. I'm hoping that someone can provide some insight or advice on what I should try next.

Note: I have administrative rights. All steps taken were done with admin privileges active.

a) I've tried the "Start>Run>shutdown -a" method in an attempt to halt the restart when it begins. It didn't work. The restart still occurred at 5am.

b) I tried changing the Windows clock in an attempt to delay the restart. It didn't work. The restart still occurred at 5am.

c) I tried disabling the Windows Time service in Control Panel>Administrative Tools>Services. It didn't work. The restart still occurred at 5am.

d) I tried methods b and c simultaneously. It didn't work. The restart still occurred at 5am.

e) I thought that the restart might be triggered remotely so I disconnected the Ethernet cable from the computer. It didn't work. The restart still occurred at 5am.

f) I tried looking into Control Panel>Task Scheduler to see if the restart was a scheduled task. It wasn't.

g) I tried looking more deeply into the Task Scheduler via the command prompt to see if perhaps there was a scheduled task that was being hidden from the Task Scheduler GUI. There wasn't.

h) I tried looking through the list of running processes (over 50) in Task Manager to see if any of the names seemed like they might be related to restarting or shutting down etc. but nothing stood out.

i) I tried making a list of all processes running before 4:30am to see if any new processes were started between 4:30am and 5am. This wasn't helpful.

j) I tried downloading and using Process Explorer in the hope that it might be able to identify the process that's causing the restart. If the program is capable of doing this then I'm not sure how. Process Explorer seemed to provided a lot of information on each process but nothing that helped me uncover what the intended function of said process was.

I've been trying to solve this puzzle for weeks now. The more time I invest in it, the harder it is for me to give up. Any help would be greatly appreciated. Thank you so much!

[SlasherKG]

It sounds like a remote restart command using the Remote Shutdown Tool.

You said multiple computers do this at the same time?

It may be a script running on your domain server or other server on your network sending the command at 5AM daily.

I'm not sure, but you should see the event in Event Viewer under System.

Might be labeled something line "Power-Troubleshooter" and look for one right around that exact time.

Edit: Nevermind, I missed item e in the list. Although the Event Viewer entry might still be valid.

[Farstrider]

I am a Linux user but have used Windows XP for many years and all I can think of is that a Windows XP equivalent to a Linux cron job is causing this to happen. In other words this is a scheduled task and that task needs to be turned off or disabled.

This is how to create scheduled tasks in Windows XP:

Creating a Scheduled Task

Open Scheduler:

Go to Start > Programs > Accessories > System Tools > Scheduled Tasks:

Double-click Add Scheduled Task:

The Scheduled Task Wizard will appear. Click Next.

Select the program to run. Choose your browser from the list (for example, Internet Explorer or Mozilla Firefox). Click Next.

Give the task a Name, such as Drupal Cron Job, and choose the Frequency with which to perform the task (for example, Daily)). Click Next.

Choose specific date and time options (this step will vary, depending on the option selected in the previous step). When finished, click Next.

Enter your password if prompted. Change the username if required (for example, you'd like the task to run under a user with fewer privileges security reasons). Click Next.

On the final page, select the checkbox Open advanced properties for this task when I click Finish and click Finish.

Configuring the task

Go to the task's setting page either by checking the checkbox at the end of the last step, or by double-clicking on the task.

In the Run box, after the text that is there now (for example, C:\PROGRA~1\MOZILL~1\firefox.exe), enter a space and then type the address to your website's cron.php page in double quotations (for example, C:\PROGRA~1\MOZILL~1\firefox.exe http://www.example.com/cron.php

To set a frequency more often than Daily (for example, hourly), click the Schedule tab, then click Advanced. Here you can set options such as Repeat task, every 1 hour for 23 hours. Click Ok when finished.

Change the start time on the task to one minute from the current time. This will allow you to test the task and make sure that it is working.

When all settings have been configured to your liking, click Apply and OK (note: you may be prompted for your password)

Reread your post and it all sounds rather odd actually so this is probably not really going to help.

[Shane Nokes]

I agree with the Event Viewer advice.

Event Viewer should always tell you what initiated a shutdown procedure.

[Detection]

If it's not windows doing it (which I agree with above, it must be), and its not happening remotely, the last thing I can think of is something in the BIOS, try resetting the BIOS to defaults / check the battery ?

Main power issue? Maybe 5am something happens with the power to cause the systems to shutdown due to a power loss / spike ? Bit far fetched though