Event ID 3005 — Windows Shutdown

Event ID 3005 — Windows Shutdown

Updated: November 30, 2007

Applies To: Windows Server 2008

Windows shutdown is the process whereby the operating system, in response to a user action or scripted command, terminates applications, processes, and services in the proper order to switch off the computer.

Event Details

Product: Windows Operating System
ID: 3005
Source: Microsoft-Windows-Wininit
Version: 6.0
Symbolic Name: EVENT_SHUTDOWN_WINDOWS_FAILURE
Message: Windows start-up process has failed to terminate system processes.

Diagnose

This error might be caused by one of the following conditions:

  • A service failed to start.
  • Windows was unable to shut down properly.

A service failed to start

To determine if a service failed to start:

  1. Click Start, point to Administrative Tools, and then click Event Viewer.
  2. In the Event Viewer (Local) pane, double-click Windows Logs.
  3. Select the System log. A white exclamation point in a red circle indicates that a service or driver is stopped or has failed to start. A black exclamation point in a yellow triangle indicates warnings, such as low disk space. For more information about an entry, click the entry, and read the General tab.
  4. If a service failed to start, see the “Restart the service” section.

Windows was unable to shut down properly

To determine if Windows was unable to shut down properly:

  1. Right-click the taskbar, and then click Task Manager.
  2. On the Application tab, locate processes whose status is Not responding. Click the process and then click End process to end these processes manually.
  3. Continue the shutdown process and completely shut down the computer before restarting.
  4. Click Start, point to Administrative Tools, and then click Event Viewer.
  5. In the Event Viewer (Local) pane, double-click Windows Logs.
  6. Select the System log and verify that a shutdown event was recorded.
  7. Attempt the shutdown again. If Windows is unable to shut down, see the “Shut down the system by turning the power off” section.

Resolve
Restart the service

During Windows shutdown, Windows stops the services that are running on the computer. If a service failed to start or stop properly, it might have stopped responding and locked system resources, which might prevent automatic shutdown of the system.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To restart the service:

  1. Use the error code to determine the service that failed to start.
  2. Click Start, type services.msc, and then press ENTER.
  3. In the Services pane, locate the service that failed to start.
  4. Right-click the service, and then click Start.

Shut down the system by turning the power off

Errors with services and process that are encountered during shutdown can prevent user interaction with the system. If the system has become completely unresponsive to user input, then the system will have to be shut down by interrupting the power supply to the computer for sufficient time to allow the system to completely shut down.

To shut down the computer by turning the power off:

  1. Right-click the taskbar, and then click Task Manager.
  2. Locate processes that are not responding and terminate those processes manually.
  3. Press and hold the power button on the computer for 15-30 seconds. If that does not shut down the computer, disconnect the computer from the power supply by either unplugging it from the power outlet or disconnecting the battery or uninterruptable power supply.

Verify

The Windows shutdown process is used to shut down both local computers and remote computers. There may be situations where shutdown is working correctly for local computers but not for remote computers.

To verify that the Windows shutdown process completes successfully:

  • Observe that the computer switches off automatically when Shut Down is selected from the Start menu.
  • Use the Windows Scheduler to schedule the shutdown process.
  • Access the shutdown process from Task Manager and manually shut down the Windows initialization process (winit.exe).

Related Management Information

Windows Shutdown

Core Security

Related:

A non-delivery report with a status code of number was generated for recipient %2 (Message-ID id). Cause: The maximum hop count was exceeded for this message. This non-delivery report can also be caused if a looping condition exists between sending and receiving servers that are not in the same Exchange organization. In this situation, the message bounces back and forth until the hop count is exceeded. A configuration error in the e-mail system can also cause the message to bounce between two servers or to be forwarded between two recipients. Solution: The maximum hop count is a property set on each virtual server and you can manually override it. The default maximum hop count is 15. Also, check for any situations that might cause loops between servers.

Details
Product: Exchange
Event ID: 3005
Source: MSExchangeTransport
Version: 6.5.6940.0
Component: Microsoft Exchange Transport
Message: A non-delivery report with a status code of number was generated for recipient %2 (Message-ID id). Cause: The maximum hop count was exceeded for this message. This non-delivery report can also be caused if a looping condition exists between sending and receiving servers that are not in the same Exchange organization. In this situation, the message bounces back and forth until the hop count is exceeded. A configuration error in the e-mail system can also cause the message to bounce between two servers or to be forwarded between two recipients. Solution: The maximum hop count is a property set on each virtual server and you can manually override it. The default maximum hop count is 15. Also, check for any situations that might cause loops between servers.
   
Explanation

This event is logged when a non-delivery report is generated because a message exceeded the maximum hop count. The default maximum hop count for SMTP virtual servers in Exchange Server 2003 is 30. The hop count to use depends on the organization’s Exchange topology. The default value is generally large enough for most Exchange environments. This event can also be logged if a looping condition exists between sending and receiving servers that are not in the same Exchange organization.

   
User Action

To resolve this error, try one or both of the following:

  • Examine the Exchange routing topology and make sure that no looping condition exists.
  • Increase the hop count on the appropriate SMTP virtual servers.

Related:

Error positioning to end of log file — seek to end of log failed. Handle specified is %1. Return code from ReadEventLog is %2.

Details
Product: Windows Operating System
Event ID: 3005
Source: EvntAgnt
Version: 5.2
Symbolic Name: SNMPELEA_ERROR_LOG_SEEK
Message: Error positioning to end of log file — seek to end of log failed.
Handle specified is %1. Return code from ReadEventLog is %2.
   
Explanation

The log event record could not be read.
Event Agent ignored the error and will continue to operate normally; however, some event-to-SNMP (Simple Network Management Protocol) trap translations might be duplicated or missed. This will not affect the operation of the system.

   
User Action

No user action is required.

Related:

An error caused by reading the SystemMessage configuration from the directory indicates that generation of delivery status notifications (DSNs) and storage quota is using out-of-date or incomplete message customizations. The configuration data may be corrupt, or the Active Directory directory service may be unreachable. The error was ‘%1’

Details
Product: Exchange
Event ID: 3005
Source: MSExchangeTransport
Version: 8.0
Symbolic Name: DsnUnableToReadSystemMessageConfig
Message: An error caused by reading the SystemMessage configuration from the directory indicates that generation of delivery status notifications (DSNs) and storage quota is using out-of-date or incomplete message customizations. The configuration data may be corrupt, or the Active Directory directory service may be unreachable. The error was ‘%1’
   
Explanation

This Error event may be logged on a Hub Transport server when Microsoft Exchange Server 2007 is unable to read the delivery status notification (DSN) message configuration information from the Active Directory directory service. This Error event may also be logged on an Edge Transport server if Exchange 2007 is unable to read the DSN message configuration from Active Directory Application Mode (ADAM) directory service. This Error event may be caused if one or more of the following conditions are true:

  • If there is a connectivity problem between the Hub Transport server and Active Directory.

  • If the domain controller is not functioning correctly.

  • If the Microsoft Exchange ADAM service on an Edge Transport server has stopped.

  • If the configuration stored in Active Directory or in ADAM is corrupted.

   
User Action

To resolve this error, do one of the following:

  • If this error occurred on a Hub Transport server, try one or both of the following:

    • Verify connectivity between Active Directory and the Hub Transport server. Use the Ping or PathPing command-line tools to test basic connectivity. Use Ping to isolate network hardware problems and incompatible configurations. Use PathPing to detect packet loss over multiple-hop trips. For more information, see Microsoft Knowledge Base article 325487, How to troubleshoot network connectivity problems.

    • Run the Dcdiag command line tool to test domain controller health. To do this, run dcdiag /s:<Domain Controller Name> at a command prompt on the Exchange server. Use the output of Dcdiag to discover the root cause of any failures or warnings that it reports. For more information, see Dcdiag Overview at the Microsoft Windows Server TechCenter.

  • If this error occurred on an Edge Transport server, verify that the Microsoft Exchange ADAM service is started on the local server.

If you still can’t resolve the problem, contact Microsoft Product Support. For information about how to contact support, visit Microsoft Help and Support Web site.

For more information about DSNs, see Managing Delivery Status Notifications.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related:

Unexpected Exchange mailbox Server error: Server: [%1] User: [%2] HTTP status code: [%3]. Verify that the Exchange mailbox Server is working correctly.

Details
Product: Exchange
Event ID: 3005
Source: Server ActiveSync
Version: 6.5
Message: Unexpected Exchange mailbox Server error: Server: [%1] User: [%2] HTTP status code: [%3]. Verify that the Exchange mailbox Server is working correctly.
   
Explanation

This Error event indicates that an issue on the Exchange Server 2003 computer may be causing Exchange Server ActiveSync processes to fail. The HTTP status code specified in the message provides more information about this event.

The user specified in the event description may experience the following symptoms:

  • User receives synchronization unsuccessful errors when they try to synchronize the calendar items to their mobile devices.

  • User cannot view calendar item on their mobile devices even after a synchronization process occurs without client-side errors.

This event may be caused by the following:

  • One of the files in the virtual directories used by Exchange ActiveSync may be damaged.

  • If you are running Exchange 2003 SP2, device security settings may not be configured correctly for your environment.

  • The UrlScan security tool may be causing calendar item synchronization to fail.

   
User Action

To resolve this error, try one or more of the following:

  • Delete and re-create the virtual directories used by Exchange ActiveSync. For detailed steps, see Microsoft Knowledge Base article 883380, How to reset the default virtual directories that are required to provide Outlook Web Access, Exchange ActiveSync, and Outlook Mobile Access services in Exchange Server 2003.

  • If you are running Exchange Server 2003 Service Pack 2 (SP2) computer, make sure that you have correctly configured device security settings for your environment. For information about the device security settings features added in Exchange Server 2003 SP2, see “Configure Security Settings for Mobile Devices”, in Exchange Server 2003 Help.

  • If you are using the UrlScan security tool, make sure that it is configured correctly. For informationa bout UrlScan, see Microsoft Knowledge Base article 326444, How to configure the URLScan Tool.

  • If these user actions do not let the user synchronize calendar items, move the mailbox of the user specified in the event description to a different Exchange Server computer.

For more information about how to troubleshoot Exchange ActiveSync synchronization issues, review the following resources:

Related: