SBS 2011 Standard SP1 - Randomly rebooting after svchost crash

Question

Last week 10/22, my SBS 2011 server began restarting randomly anywhere from every 2 hours to as long as every 4 hours. In reviewing the logs, it appears that an svchost process crashes (in Application log) which surrounds ntdll.dll and then many services
crash and the System log shows a request by RPC to restart the server.
I have seen similar threads but none of them end up with a solution or viable suggestion.
No changes were made to the server on that day but since this began, I have installed all updates to drivers and the OS but no change.
Log Name:      Application
Source:        Application Error
Date:          10/29/2014 1:30:45 PM
Event ID:      1000
Task Category: Application Crashing Events
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SERVER.domain.local
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000005
Fault offset: 0x00000000000506f1
Faulting process id: 0x2a0
Faulting application start time: 0x01cff38404ccfa2d
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: b1d8e3b5-5f99-11e4-8531-e83935b894d8
Event Xml:
<Event xmlns="removed because wouldn't let me save">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-29T18:30:45.000000000Z" />
    <EventRecordID>3836089</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERVER.domain.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>svchost.exe</Data>
    <Data>6.1.7600.16385</Data>
    <Data>4a5bc3c1</Data>
    <Data>ntdll.dll</Data>
    <Data>6.1.7601.18229</Data>
    <Data>51fb164a</Data>
    <Data>c0000005</Data>
    <Data>00000000000506f1</Data>
    <Data>2a0</Data>
    <Data>01cff38404ccfa2d</Data>
    <Data>C:\Windows\system32\svchost.exe</Data>
    <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
    <Data>b1d8e3b5-5f99-11e4-8531-e83935b894d8</Data>
  </EventData>
</Event>
Log Name:      System
Source:        USER32
Date:          10/29/2014 1:30:46 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      SERVER.domain.local
Description:
The process C:\Windows\system32\services.exe (SERVER) has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x30006
 Shutdown Type: restart
 Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
Event Xml:
<Event xmlns="removed because wouldn't let me save">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-29T18:30:46.000000000Z" />
    <EventRecordID>2726522</EventRecordID>
    <Channel>System</Channel>
    <Computer>SERVER.domain.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>C:\Windows\system32\services.exe (SERVER)</Data>
    <Data>SERVER</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x30006</Data>
    <Data>restart</Data>
    <Data>Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly</Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Binary>06000300000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Answer 1

Hi John,
Before going further, would you please let me confirm whether do any change (install any update or third-party
application) before this issue occurred?
On current situation, please run
sfc /scannow command to scan all protected system files. Would you please let me know whether you updated the BIOS and the hardware drivers? Please check if drivers need to be updated and Windows Updates need to be installed. If possible, please perform
a clean boot and check if this crash issue still exists.
In addition, troubleshoot this kind of kernel crash issue, we need to analyze the crash dump file to narrow down the root cause of the issue. Please refer to following articles
and check if can help you to analyze dump files.
Crash dump analysis using the Windows debuggers (WinDbg)
How to read the small memory dump file that is created by Windows if a crash occurs
By the way, it may be not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer
Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Hope this helps.
Best regards,
Justin Gu