Shutdown reason codes are reason codes, not error codes or HRESULTs
A customer liaison asked the following question on behalf of his customer:
My customer is finding that their Windows Server 2003 system has restarted, and they want to find out why. I’ve found some event log similar to the ones below, but I don’t know what error code
0x84020004is. I’ve searched the Knowledge Base but couldn’t find anything relevant. Please let me know why the system restarted.Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 3/20/2009 Time: 11:51:30 AM User: GROUP1\infraadmin Computer: DATA2 Description: The process Explorer.EXE has initiated the shutdown of computer SYSP1 on behalf of user GROUP1\infraadmin for the following reason: Operating System: Reconfiguration (Planned) Reason Code: 0x84020004 Shutdown Type: restart Comment:
0x84020004 is not an error code.
It says right there that it’s a reason code:
Reason Code: 0x84020004
The system shutdown reason codes
are documented in MSDN under the devious heading System Shutdown Reason Codes.
In this case, the value
0x84020004 is a combination of
SHTDN_REASON_FLAG_PLANNED 0x80000000 SHTDN_REASON_FLAG_CLEAN_UI 0x04000000 // reason.h SHTDN_REASON_MAJOR_OPERATINGSYSTEM 0x00020000 SHTDN_REASON_MINOR_RECONFIG 0x00000004
That value for
SHTDN_REASON_FLAG_CLEAN_UI is missing
from the MSDN documentation for some reason, but’s listed in
The flag means that the system was shut down in a controlled manner,
as opposed to
SHDTN_REASON_FLAG_DIRTY_UI which means
that the system lost power and did not go through a clean shutdown.
In other words, this was a planned shutdown that was the result of an operating system reconfiguration. Perhaps somebody changed a system setting in the Control Panel, and in response to the question “The change you made requires that the system be restarted. Restart now?”, the person said Yes.