I am trying to figure out who might be doing this. I do not see any
worker bees in the administrator group. The worker bees do not see the
actual shutdown option according to one of the staff. Event log has an
entry for event logging shutting down so it looks to be a contolled
shutdown. I see that I can turn on logging for successful login but I
do not see any logoff tracking. Am I missing something?
Jim B. SBS Community Member
remove the mvp to send email

Re: Application server shuts down by Merv

Merv
Wed Nov 10 19:02:01 CST 2004

Hye Jim:

Maybe a scheduled shutdown test by your UPS software?

--
Merv Porter [SBS MVP]
===================================
"Jim Behning" <jimbehningmvp@atl.mindspring.com> wrote in message
news:hvd5p0hrqfnv6jqdrm90o94n88lo8nsjma@4ax.com...
> I am trying to figure out who might be doing this. I do not see any
> worker bees in the administrator group. The worker bees do not see the
> actual shutdown option according to one of the staff. Event log has an
> entry for event logging shutting down so it looks to be a contolled
> shutdown. I see that I can turn on logging for successful login but I
> do not see any logoff tracking. Am I missing something?
> Jim B. SBS Community Member
> remove the mvp to send email



Re: Application server shuts down by Jim

Jim
Wed Nov 10 20:31:31 CST 2004

No ups connected to that server. It has the feel of users logging off
which really means someone is seeing and using the shutdown command.
Today it shut down at 4:58. I just pressed the on button and a person
was logged back on in a few minutes. I think that was the only
employee left.

"Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:

>Hye Jim:
>
>Maybe a scheduled shutdown test by your UPS software?

Jim B. SBS Community Member
remove the mvp to send email

Re: Application server shuts down by Merv

Merv
Wed Nov 10 21:10:19 CST 2004

Could someone (or some software) be shutting it down remotely?
Anything in the Scheduled Tasks?
Could someone with elevated privileges be remoting into the server to remote
control its apps and then just selecting "shutdown" when they're done
(treating it like a local computer)?

--
Merv Porter [SBS MVP]
===================================
"Jim Behning" <jimbehningmvp@atl.mindspring.com> wrote in message
news:9kj5p0t2io69a1g773430hedu6csutptai@4ax.com...
> No ups connected to that server. It has the feel of users logging off
> which really means someone is seeing and using the shutdown command.
> Today it shut down at 4:58. I just pressed the on button and a person
> was logged back on in a few minutes. I think that was the only
> employee left.
>
> "Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:
>
> >Hye Jim:
> >
> >Maybe a scheduled shutdown test by your UPS software?
>
> Jim B. SBS Community Member
> remove the mvp to send email



Re: Application server shuts down by Jim

Jim
Wed Nov 10 21:25:02 CST 2004

I was talking to one of the tech support people. It was not him. The
other tech support people do not answer or return phone calls. Of
course with how well their product works it is no wonder they do not
answer the phone.

I do not think anyone is in a special group anymore that can shut the
server down.

Have anyone seen a tool that digs into AD and list groups and members
or users with their membership? I know I am whining but digging
through 50 users and a slew of security groups is getting frustrating.
If I have to keep up with the grunt work then lucky me.

"Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:

>Could someone (or some software) be shutting it down remotely?
>Anything in the Scheduled Tasks?
>Could someone with elevated privileges be remoting into the server to remote
>control its apps and then just selecting "shutdown" when they're done
>(treating it like a local computer)?
>
>--
>Merv Porter [SBS MVP]
>===================================
>"Jim Behning" <jimbehningmvp@atl.mindspring.com> wrote in message
>news:9kj5p0t2io69a1g773430hedu6csutptai@4ax.com...
>> No ups connected to that server. It has the feel of users logging off
>> which really means someone is seeing and using the shutdown command.
>> Today it shut down at 4:58. I just pressed the on button and a person
>> was logged back on in a few minutes. I think that was the only
>> employee left.
>>
>> "Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:
>>
>> >Hye Jim:
>> >
>> >Maybe a scheduled shutdown test by your UPS software?
>>
>> Jim B. SBS Community Member
>> remove the mvp to send email
>

Jim B. SBS Community Member
remove the mvp to send email

Re: Application server shuts down by Merv

Merv
Thu Nov 11 06:22:03 CST 2004

You might want to try Hyena from SystenTools.com. I've only played with the
the free 30 day (full) trial version on a WinXP system but it looked pretty
good. Under the "rights" section it lists "SESHUTDOWNPRIVILEGES" which
tells you what groups have the right to shut down the computer. It also
dumps group/users memberships.

http://www.systemtools.com/index.html

--
Merv Porter [SBS MVP]
===================================
"Jim Behning" <jimbehningmvp@atl.mindspring.com> wrote in message
news:pkm5p0tsik3urlvc6eg892vnc1hdg3subc@4ax.com...
> I was talking to one of the tech support people. It was not him. The
> other tech support people do not answer or return phone calls. Of
> course with how well their product works it is no wonder they do not
> answer the phone.
>
> I do not think anyone is in a special group anymore that can shut the
> server down.
>
> Have anyone seen a tool that digs into AD and list groups and members
> or users with their membership? I know I am whining but digging
> through 50 users and a slew of security groups is getting frustrating.
> If I have to keep up with the grunt work then lucky me.
>
> "Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:
>
> >Could someone (or some software) be shutting it down remotely?
> >Anything in the Scheduled Tasks?
> >Could someone with elevated privileges be remoting into the server to
remote
> >control its apps and then just selecting "shutdown" when they're done
> >(treating it like a local computer)?
> >
> >--
> >Merv Porter [SBS MVP]
> >===================================
> >"Jim Behning" <jimbehningmvp@atl.mindspring.com> wrote in message
> >news:9kj5p0t2io69a1g773430hedu6csutptai@4ax.com...
> >> No ups connected to that server. It has the feel of users logging off
> >> which really means someone is seeing and using the shutdown command.
> >> Today it shut down at 4:58. I just pressed the on button and a person
> >> was logged back on in a few minutes. I think that was the only
> >> employee left.
> >>
> >> "Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:
> >>
> >> >Hye Jim:
> >> >
> >> >Maybe a scheduled shutdown test by your UPS software?
> >>
> >> Jim B. SBS Community Member
> >> remove the mvp to send email
> >
>
> Jim B. SBS Community Member
> remove the mvp to send email



Re: Application server shuts down by Jim

Jim
Tue Nov 16 21:57:54 CST 2004

Hyena is a cool tool. I ripped and I ripped getting people out of
groups that are not used in other accounts. It did not make a bit of
difference. Such frustration. You know DCs do not have local users and
groups. Member servers do. 6 users in the local administrator group on
the application server. I yanked them all out today. It only took me
two weeks to discover that.

"Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:

>You might want to try Hyena from SystenTools.com. I've only played with the
>the free 30 day (full) trial version on a WinXP system but it looked pretty
>good. Under the "rights" section it lists "SESHUTDOWNPRIVILEGES" which
>tells you what groups have the right to shut down the computer. It also
>dumps group/users memberships.
>
>http://www.systemtools.com/index.html
>
>--
>Merv Porter [SBS MVP]
>===================================
>"Jim Behning" <jimbehningmvp@atl.mindspring.com> wrote in message
>news:pkm5p0tsik3urlvc6eg892vnc1hdg3subc@4ax.com...
>> I was talking to one of the tech support people. It was not him. The
>> other tech support people do not answer or return phone calls. Of
>> course with how well their product works it is no wonder they do not
>> answer the phone.
>>
>> I do not think anyone is in a special group anymore that can shut the
>> server down.
>>
>> Have anyone seen a tool that digs into AD and list groups and members
>> or users with their membership? I know I am whining but digging
>> through 50 users and a slew of security groups is getting frustrating.
>> If I have to keep up with the grunt work then lucky me.
>>
>> "Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:
>>
>> >Could someone (or some software) be shutting it down remotely?
>> >Anything in the Scheduled Tasks?
>> >Could someone with elevated privileges be remoting into the server to
>remote
>> >control its apps and then just selecting "shutdown" when they're done
>> >(treating it like a local computer)?
>> >
>> >--
>> >Merv Porter [SBS MVP]
>> >===================================
>> >"Jim Behning" <jimbehningmvp@atl.mindspring.com> wrote in message
>> >news:9kj5p0t2io69a1g773430hedu6csutptai@4ax.com...
>> >> No ups connected to that server. It has the feel of users logging off
>> >> which really means someone is seeing and using the shutdown command.
>> >> Today it shut down at 4:58. I just pressed the on button and a person
>> >> was logged back on in a few minutes. I think that was the only
>> >> employee left.
>> >>
>> >> "Merv Porter [SBS-MVP]" <mwport@no_spam_hotmail.com> wrote:
>> >>
>> >> >Hye Jim:
>> >> >
>> >> >Maybe a scheduled shutdown test by your UPS software?
>> >>
>> >> Jim B. SBS Community Member
>> >> remove the mvp to send email
>> >
>>
>> Jim B. SBS Community Member
>> remove the mvp to send email

Jim B. SBS Community Member
remove the mvp to send email