An unexpected shutdown message is displayed when first login to Windows after restoring the system with System Recovery Disk (SRD)
The message does not continue to occur on additional reboots.
After a full OS recovery and reboot of a Windows Server, upon first login, a pop-up message (Windows Event Tracker) is observed. (Figure 1)
"Why did the computer shut down unexpectedly?"
A reason is required in the Comment text field before proceeding.
This is a benign message and can be safely ignored.
Listed below are steps for a workaround to avoid generating the message when first login to Windows after restoring the system.
- Do not reboot soon after recovering the SRD restore, and go back to main menu.
- From the main menu choose 'Analyze'.
- Click the menu option, ‘Open Command Shell Window’.
- At the command prompt type: regedit and press the enter key.
- Navigate to "HKEY_LOCAL_MACHINE".
- From the FILE pull down menu choose, ‘Load Hive’.
- Navigate to the restored system's "[Drive letter]:\Windows\System32\Config" folder.
Note: [Drive letter] is a drive letter except X drive.
- Select the SOFTWARE file; it will be the one w/o a file extension then click the OK button.
- Enter "restored_software" as a key name.
- Navigate to "HKEY_LOCAL_MACHINE\restored_software\Microsoft\Windows\CurrentVersion\Reliability".
- Delete "LastAliveStamp" key.
- Navigate back to "HKEY_LOCAL_MACHINE\restored_software".
- Click Yes to save changes to the restored system's SOFTWARE hive.
- Close regedit.
- Type Exit at the Command Shell Window.
- Click the Exit bottom SRD main window.
- Reboot the recovered system.
Note: For more information regarding LastAliveStamp and Shutdown Event Tracker Tools, see Microsoft KB Article 778526:
Symantec Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec Corporation is committed to product quality and satisfied customers.
This issue is currently under investigation by Symantec Corporation. Pending the outcome of the investigation, this issue may be resolved by way of a patch or hotfix in current or future revisions of the software. However, this particular issue is not currently scheduled for any release. If you feel this issue has a direct business impact for you and your continued use of the product, please contact your Symantec Sales representative or the Symantec Sales group to discuss these concerns. For information on how to contact Symantec Sales, please see http://www.symantec.com Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here.