Unexpected Shutdown in Shutdown Event Tracker or Event ID 6008 in the Event Log after ESX shutdown

Issue

When an ESX server shuts down, and shuts down the running Windows Server 2003 Virtual Machines, they may not shutdown cleanly.

The Shutdown Event Tracker reports the following when logging in the first time after the server is restarted:

Why did the computer shutdown unexpectedly?
"Other (Unplanned)"

The following event appears in the System Event Log:

Source: EventLog
Event ID: 6008
Description: The previous system shutdown at H:MM:SS PM on DD/MM/YYYY was unexpected.

Resolution

Configure the autostop option to use soft power off. Edit the .vmx file and add the following entry:

autostop = "softpoweroff"

This can also be added from the MUI web interface on the ESX server from:
Status Monitor | <Virtual Machine> | Configure Options | Verbose Options | Add

This error can also be caused be having an RDP Terminal Services session running, as it prompts the user:

"If you shutdown this computer, no one can use it until someone at the remote location restarts it.
Do you want to continue shutting down?"

It will stay on this prompt until it times out and powers off.

There is also a Windows server 2003 hotfix to address shutdown issues:

The computer does not automatically shut down when the Shutdown.exe command is invoked
http://support.microsoft.com/kb/821287

Products

VMware ESX 2.5.X
Microsoft Windows Server 2003 SP1
Microsoft Windows Server 2003 RTM

Created: 14th September 2006
Updated: 5th October 2006


© 2005-2014 Jamie Morrison