Windows 2003 Server reboot but not unexpected, couldnt find the trigger for reboot

Question

Hi All,
I have windows 2003 Server 32 bit,std. Which is getting rebooted every 2 days once at 5 AM. I couldnt find the cause for the reboot. Need
I dont see anything in system log apart from event 6006 (event log service stopped).
Enabled advanced Auditing , nothing suspecious found.
No scheduled task or job.
Antivirus scan is clean, no internet access to the box.
Its Virtual machine, all other VM's hosted on ESX server (where the machine with issue hosted) are working fine.
Removed all users admin rights.
Disabled NIC to check if the reboot intiatation happening from network, however server still reboots at 5.
Run process monitor and saved the file at 4:59:38 AM (just before the reboot), nothing supecious found.
Its used for build , various versions of Visual Studio is installed on the box and other tools are installed too.
However could not find a reason or log to find what is causing these reboot.
Need a direction on troubleshooting this urgently.
In application event log i see below.
The description for Event ID ( 0 ) in Source ( Poweroff ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to
retrieve this description; see Help and Support for details. The following information is part of the event: ExitWindowsEx executed succesfully!.
The description for Event ID ( 0 ) in Source ( Poweroff ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to
retrieve this description; see Help and Support for details. The following information is part of the event: Initiating FORCE REBOOT.

Answer 1

Hi,
I agree with Dave Patrick, please confirm there have any software trigger the Windows restart API, and please refer the following hotfix scenario applied to your environment
or not.
More information:
You may experience an abnormal shutdown on a Windows Server 2003-based computer after the Windows logon screen saver starts
http://support.microsoft.com/kb/916719/en-us
Why Windows NT Reports 6005, 6006, 6008, and 6009 Event Log Entries
http://support.microsoft.com/kb/196452/en-us
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.