Server shutdown randomly - winlogon.exe + other clues

Question

Hello,
This has started happening since last week. Every day (sometimes more than once), the server (Windows Server 2003) would shut-down or restart by itself.
I've investigated in the event viewer, and noticed 2 things:
1. Every single time this happens, in the system log, it has "the process winlogon.exe has initiated the power off of a computer", and this is always from USER32.
2. In the security log, at almost the exact same time as the above "winlogon.exe", I would see an entry with "attempted logon by MICROSOFT_AUTHENTICATION_PACKAGE_v1_0". Within seconds of this logon, the server then shuts down by itself.
I've ran 2 virus scans, and monitored in process explorer for any suspicious processes, but found nothing. It looks like the shutdown is directly related to this logon attempt.
Any help would be greatly appreciated, as this is extremely troublesome.
Thank you.

Answer 1

Hello, an update, as the problem is still happening.
As suggested I've disabled the un-used accounted. I've also changed the password for all the existing user accounts. Although this didn't fix the problem, now I don't see the winlogon.exe or USER32 initiated the shut-down in the event viewer anymore. In
fact, whenever a random shut-down occurs, I literally see nothing in the event viewer that is related or has the same time occurrence as the shut-down itself.
Being frustrated, I performed more tests and fixes:
- Thought it might be due to over-heating, I cleaned the server inside out. The fans are all working, and I don't see any temperature that's too high.
- I ran 3-4 anti-virus scans, in both normal mode and safe mode. All found no virus.
- An interesting thing, I left the server on Safe Mode on purpose to see if it still shuts-down. And behold, it still randomly shuts down in safe mode as well.
- I also wrote a small program, that runs "shutdown -a" and loops itself every 5 seconds. Hoping this would at least manually stop the shut-down. It worked when I tested it with a scheduled shutdown called by shutdown.exe. But the system still shuts down.
This has been a nightmare!