Windows 7 / Getting Started

---

Shutting Down and Restarting RD Session Host Servers

When you've drained the server of users and notified anyone who is still connected to the server, you can shut it down. You've probably shut down a server from the GUI; shutting down an RD Session Host server is no different. However, because you might not have shut it down from the command prompt, the focus is on that option here.

NOTE The tsshutdown command used in Windows Server 2003 was discontinued in Windows Server 2008 and Windows Vista. Use the shutdown command instead. You must be an administrator to shut down or reboot an RD Session Host server. Users do not get access to the Shut Down, Restart, Hibernate, or Sleep option on the Start menu when working in a session. Nor can they execute the shutdown command.

Shutting down and rebooting an RD Session Host server from the Start menu is no different from shutting down or rebooting a Windows Server 2008 R2 server (without RDS installed) or a Windows 7 client. Go to Start and then click the arrow to the right of the lock button on the lower right of the menu. A menu pops up; choose either Restart or Shut Down.

When you choose to shut down or restart a server, you will see a pop-up window in which you need to choose a reason for the shutdown/reboot from the Option drop-down menu. Also, indicate whether the action was planned or unplanned, type any comments that you want to add in the Comments window, and click OK. This information is recorded in the server System Event Log (Event ID 1074). This logging is helpful for keeping track of who rebooted or shut down a server, and why they did so. Giving detailed information in the Comments area can make it easier for another administrator to figure out the exact reason for a reboot. For instance, if you install an application update, you can add a comment in the Shut Down Windows dialog box indicating exactly which one it was, which saves time if someone else needs the details later.

You can also use the shutdown command to shut down or restart a server from the command line. This command can be run from a Windows Server 2008 R2 server or even a Windows 7 client. The command syntax is

shutdown [/i | /l | /s | /r | /g | /a | /p | /h | /e] [/f] [/m \\computer][/t xxx]
   [/d [p|u:]xx:yy [/c"comment"]]

NOTE: Typing shutdown at a command prompt gives you the same command syntax and arguments as typing shutdown /?.

Table-5 shows a list of the command-line arguments available for the shutdown command.

TABLE-5 Arguments for the shutdown Command

ARGUMENT	INPUT	DETAILS
No arguments		Displays the command syntax and arguments. This is the same as typing /?.
/?		Displays the command syntax and arguments.
/i		Displays the GUI Shutdown. This must be the first option if used with other options. Use this option to shut down or reboot more than one computer at a time.
/l		Log off the computer. This cannot be used with the /m or /d option.
/s		Shuts down the computer.
/r		Restarts the computer.
/g		Restarts the computer and then starts registered applications.
/a		Aborts a system shutdown, but can be used only against the shutdown command given with a timeout period (/t xxx).
/p		Turns off the local computer with no timeout or warning. Can be used with the/d and /f options.
/h		Hibernates the local computer. Can be used with the /f option.
/e		Supposed to be used to document the reason for an unexpected shutdown of a computer, but it does nothing. Use the /c argument instead.
/m	\\computername	Specifies the target computer to shutdown or reboot.
/t	xxx	Set the timeout period before shutdown or reboot to xxx seconds. The valid range is 0-600, with a default of 30. Using /t xxx implies the /f option.
/c	"comment"	Add a comment about the reason for the restart or shutdown. Maximum of 512 characters allowed.
/f		Forces running applications to close without forewarning users; /f is automatically set when used in conjunction with /t xxx.
/d	[p|u:]xx:yy	Indicates the reason for the restart or shutdown; p indicates that the restart or shutdown is planned; u indicates that the reason is user-defined. If neither p nor u is specified, the restart or shutdown is unplanned; xx is the major reason number (positive integer less than 256); yy is the minor reason number (positive integer less than 65536). (See next Table-6 for a reason code reference.)

Instead of running through every option the shutdown command offers, the following information highlights some options applicable to an RDS environment.

Using the command-line utility means that you can shut down or reboot a server remotely. For instance, to shut down the server FUJI from a remote Windows 7 client, the command looks like this.

shutdown /m \\FUJI

Use the /r command to reboot a server like this.

shutdown /r /m \\FUJI

As with shutting down or rebooting from the GUI, it's good to document why the event is occurring. Use the /c argument to add a comment to the event to get recorded in the event log. For example, this command shuts down FUJI and adds a comment to explain the reason for the shutdown.

shutdown /r /m \\FUJI /c Installed accounting application update.

To document the planned reason for a shutdown or to restart via the command-line interface (CLI), use codes that correspond to the Option drop-down menu in the Windows Shut Down dialog box. The syntax for choosing a reboot code is shutdown /d [p|u:]xx:yy. The letters p and u indicate a planned action or user-defined action, respectively. The letter combination xx indicates the major reason number code; yy indicates the minor reason error code. Table-6 shows the reasons and corresponding code numbers.

TABLE-6 Major and Minor Number Codes Corresponding to Reasons for a Server Shutdown or Reboot

TYPE E = EXPECTED U = UNEXPECTED P = PLANNED	MAJOR	MINOR	TITLE/EXPLANATION
U	0	0	Other (Unplanned)
E	0	0	Other (Unplanned)
E P	0	0	Other (Planned)
U	0	5	Other Failure: System Unresponsive
E	1	1	Hardware: Maintenance (Unplanned)
E P	1	1	Hardware: Maintenance (Planned)
E	1	2	Hardware: Installation (Unplanned)
E P	1	2	Hardware: Installation (Planned)
P	2	3	Operating System: Upgrade (Planned)
E	2	4	Operating System: Reconfiguration (Unplanned)
E P	2	4	Operating System: Reconfiguration (Planned)
P	2	16	Operating System: Service pack (Planned)
	2	17	Operating System: Hot fix (Unplanned)
P	2	17	Operating System: Hot fix (Planned)
	2	18	Operating System: Security fix (Unplanned)
P	2	18	Operating System: Security fix (Planned)
E	4	1	Application: Maintenance (Unplanned)
E P	4	1	Application: Maintenance (Planned)
E P	4	2	Application: Installation (Planned)
E	4	5	Application: Unresponsive
E	4	6	Application: Unstable
U	5	15	System Failure: Stop error
E	5	19	Security issue
	5	19	Security issue
	5	19	Security issue
	5	20	Loss of network connectivity (Unplanned)
	6	11	Power Failure: Cord Unplugged
	6	12	Power Failure: Environment
	7	0	Legacy API shutdown

For instance, to reboot the server FUJI and document the reboot as being due to application maintenance, the command is

shutdown /r /m \\FUJI /d p:4:1

Running the preceding command remotely produces Event ID 1074 in the System Event Log on the server that is rebooted, with a description of the action that occurs. The data includes the user name that initiated the request, the IP address of the computer the request comes from, and the reason for the request.

The process wininit.exe (10.10.10.23) has initiated the restart of computer FUJI on
behalf of user ASH\Administrator for the following reason: Application: Maintenance
(Planned)

Shutdown.exe is also helpful if you need to reboot many servers. To do so, run the following command.

shutdown /i

This command brings up the dialog box named Remote Shutdown Dialog, which gives you the ability to specify more than one computer to shut down or restart.

Click Add and type the name of the computer that you want to shut down or restart. Do this for all computers you want to shut down or restart and then choose the action you want to perform from the What Do You Want These Computers To Do drop-down menu.

• Restart
• Shutdown
• Annotate Unexpected Shutdown

NOTE: The Annotate Unexpected Shutdown option works only if you previously had an unexpected shutdown or restart.

Choose the reason for this action by selecting the appropriate choice from the Option drop-down menu and add any comments in the Comment text box. Then click OK.

As an example, if you perform scheduled server maintenance, such as running some updates every Sunday, and include a reboot, you can automate the reboot process by creating a scheduled task with the Windows Server 2008 Task Scheduler or by using the command-line tool schtasks. For example, to reboot the server FUJI every Sunday night at midnight, use the schtasks command as shown here.

schtasks.exe /create /SC WEEKLY /D SUN /RU admin@ash.local /RP "xxxxxxxx" /TN RebootFUJI
/TR "C:\windows\system32\shutdown.exe /m \\FUJI /r /c FUJI-WindowsUpdates-Reboot" /ST
12:00

If a shutdown or reboot attempt fails, Event ID 1073 is logged in the System Event Log of the server that fails to reboot. The log won't tell you why the action failed, but it will at least let you know that it did fail and which user account issued the command. If you like, you can use Schtasks.exe to create a task that performs an action such as running a script that emails you every time the event ID appears. The details of Server-reboot-failed.vbs are in the next sidebar, "Direct from the Field: Email Yourself When a Reboot Fails."

schtasks.exe /Create /TN EventLog-1073 /TR "cscript\\colfax\ash-company-files\IT\
Scripts\server-reboot-failed.vbs" /SC ONEVENT /EC System /MO *[System/EventID=1073]