An unexpected shutdown message is displayed when first login to Windows after restoring the system with System Recovery Disk (SRD)

Article:TECH216392  |  Created: 2014-04-03  |  Updated: 2014-04-06  |  Article URL http://www.symantec.com/docs/TECH216392
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution



Issue



An unexpected shutdown message is displayed when first login to Windows after restoring the system with System Recovery Disk (SRD)
The message does not continue to occur on additional reboots.


Error



After a full OS recovery and reboot of a Windows Server, upon first login, a pop-up message (Windows Event Tracker) is observed. (Figure 1)

"Why did the computer shut down unexpectedly?"

 A reason is required in the Comment text field before proceeding.

Figure 1


Solution



This is a benign message and can be safely ignored.

Listed below are steps for a workaround to avoid generating the message when first login to Windows after restoring the system.
 

Workaround :

  1. Do not reboot soon after recovering the SRD restore, and go back to main menu.
  2. From the main menu choose 'Analyze'.
  3. Click the menu option, ‘Open Command Shell Window’.
  4. At the command prompt type: regedit and press the enter key.
  5. Navigate  to "HKEY_LOCAL_MACHINE".
  6. From the FILE pull down menu choose, ‘Load Hive’.
  7. Navigate to the restored system's  "[Drive letter]:\Windows\System32\Config" folder.
    Note: [Drive letter] is a drive letter except X drive.
  8. Select the SOFTWARE file; it will be the one w/o a file extension then click the OK button.
  9. Enter  "restored_software" as a key name.
  10. Navigate to "HKEY_LOCAL_MACHINE\restored_software\Microsoft\Windows\CurrentVersion\Reliability".
  11. Delete "LastAliveStamp" key.
  12. Navigate back to "HKEY_LOCAL_MACHINE\restored_software".
  13. Click Yes to save changes to the restored system's SOFTWARE hive.
  14. Close regedit.
  15. Type Exit at the Command Shell Window.
  16. Click the Exit bottom SRD main window.
  17. Reboot the recovered system.

Note: For more information regarding LastAliveStamp and Shutdown Event Tracker Tools, see Microsoft KB Article 778526:
 http://technet.microsoft.com/en-us/library/cc778526.aspx



Symantec Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec Corporation is committed to product quality and satisfied customers.
 
This issue is currently under investigation by Symantec Corporation. Pending the outcome of the investigation, this issue may be resolved by way of a patch or hotfix in current or future revisions of the software. However, this particular issue is not currently scheduled for any release.  If you feel this issue has a direct business impact for you and your continued use of the product, please contact your Symantec Sales representative or the Symantec Sales group to discuss these concerns.  For information on how to contact Symantec Sales, please see  http://www.symantec.com Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here.

 


Supplemental Materials

SourceETrack
Value3478461
Description

CORE: Shutdown Event Tracker pops up and "The previous system shutdown was unexpected" is logged on Event Viewer after the first boot on the recovered Windows 2012.



Article URL http://www.symantec.com/docs/TECH216392


Terms of use for this information are found in Legal Notices