Shutdown reason codes are reason codes, not error codes or HRESULTs

A customer liaison asked the following question on behalf of his customer:

My customer is finding that their Windows Server 2003 system has restarted, and they want to find out why. I've found some event log similar to the ones below, but I don't know what error code 0x84020004 is. I've searched the Knowledge Base but couldn't find anything relevant. Please let me know why the system restarted.

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 3/20/2009
Time: 11:51:30 AM
User: GROUP1\infraadmin
Computer: DATA2
Description:
The process Explorer.EXE has initiated the shutdown of computer SYSP1 on behalf
of user GROUP1\infraadmin for the following reason: Operating System:
Reconfiguration (Planned)
Reason Code: 0x84020004
Shutdown Type: restart
Comment:
The value 0x84020004 is not an error code. It says right there that it's a reason code:

Reason Code: 0x84020004
The system shutdown reason codes are documented in MSDN under the devious heading System Shutdown Reason Codes. In this case, the value 0x84020004 is a combination of

SHTDN_REASON_FLAG_PLANNED               0x80000000
SHTDN_REASON_FLAG_CLEAN_UI              0x04000000 // reason.h
SHTDN_REASON_MAJOR_OPERATINGSYSTEM      0x00020000
SHTDN_REASON_MINOR_RECONFIG             0x00000004

That value for SHTDN_REASON_FLAG_CLEAN_UI is missing from the MSDN documentation for some reason, but's listed in reason.h. The flag means that the system was shut down in a controlled manner, as opposed to SHDTN_REASON_FLAG_DIRTY_UI which means that the system lost power and did not go through a clean shutdown.

Read more: The old new thing

Posted via email from .NET Info