Event ID 1074 Reason code 0x500ff with rebooter.exe

[carlos]

How does "rebooter.exe" execute the reboots?

The process C:\Windows\system32\winlogon.exe (WIN-S1P1OUA9ROH) has initiated the restart of computer WIN-S1P1OUA9ROH on behalf of user WIN-S1P1OUA9ROH\Administrator for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: restart
Comment:

I'm getting these events when performing reboots with "rebooter.exe" (Burning V8 Pro 1037), according to the link bellow, a reason code 0x500ff is a system failure, is this a windows bug or rebooter sending the incorrect information to the Sel?


"Reason Code: 0x500ff Shutdown Type: power off
Event 0x000500FF (System Failure) is written to the SEL (System Event Log) even if a different shutdown reason was provided by the user who initiated the shutdown"



https://support.microsoft.com/en-us/kb/2001061

Thanks,

[David (PassMark)]

The Window's ExitWindowsEx function is used by the Rebooter software.

See this page for documentation,
https://msdn.microsoft.com/en-us/lib...=vs.85%29.aspx

This function requires a shutdown code to the sent to the operating system.


In the case of a reboot, the code is set to, EWX_REBOOT (0x00000002).
In the case of a forced reboot, the code is set to, EWX_REBOOT | EWX_FORCE (0x00000006).

As pointed out in the Knowledge base article 2001061, there seems to be a bug in older versions of Windows where the wrong code is written to the event log.