Various restarts all over LAN at the same time

[Christiaens]

As from yesterday several computers(6) and a few servers
(3) across the entire network got the error code 128 on %
\systemroot%\system32\services.exe and started to shut
down after 60 seconds.
We tried to find what caused the problem but noting showed
up.
Last night the same thing happened only on larger scale.
Now 13 servers were rebooted with the same error message.
Again nothing showed up in event logs or firewall traffic
logs.
This afternoon the same thing happened but again more
bigger as before. About 70 computers and a lot of servers
all over our network and different subnets started to
reboot after the services.exe error message.
Not all were the same but radon computers all over the LAN.

We cannot find anything that causes this very strange
problem.

We are sure that none of the affected pc's are infected by
any know virus (Blaster etc).
All machines are running windows 2000 SP4.
No strange services are running and no tasks are scheduled.
No strange events are shown, only the unexpected shutdown
occurred message.
No strange network traffic can be found in the firewall
logs. (no broadcast from a certain pc for shutdown or
something).

Does anyone know what is happening over here?

Thank you very much in advance.

 

[Guest]

In your your local security setting is a setting under security options called 'Shutdown system immediately if unable to log security audits'. If it is enabled and you have set limits on your auditing in the event log, it will shutdown the system

grit