Issue

Windows Server 2016 (Hyper-V Host) shut down unexpectedly without any obvious external reason. The shutdown was graceful, not a crash or power cut.

Windows Event System Logs contain the following related entries:

Event ID: 109
Source: Kernel-Power
Description:
The kernel power manager has initiated a shutdown transition.
Shutdown Reason: Battery

Event ID: 1074
Source: User32
Description:
The process C:\Windows\system32\winlogon.exe (SERVER-NAME) has initiated the power off of computer SERVER-NAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: power off

Event ID: 109
Source: Kernel-Power
Description:
The kernel power manager has initiated a shutdown transition.
Shutdown Reason: Kernel API

Resolution

After some investigation, it appeared that the shutdown was caused by APC Smart-UPS that was connected to the server via a USB cable. It’s unclear what event exactly triggered to shutdown as there was no APC software installed to manage and monitor the UPS. We installed APC PowerChute Business Edition, configured the proper shutdown procedure, and set up logging / diagnostics to catch any issues in the future.

Dell PowerEdge T430
Windows Server 2016 Hyper-V Host
APC Smart-UPS 1500
APC PowerChute Business Edition