Here’s a useful tip if you’ve ever tried performing a remote reboot of a server or workstation running Windows and had the reboot get hung up.
First, some background: you can remotely reboot a machine with the following command:
shutdown /r /m \\computername
Of course, you need to be running as a user with admin rights on the remote machine. Typically, I would follow this with a ping -i computername to confirm the remote machine has rebooted.
Normally, after a minute or two, you’ll see the machine stop responding to ping, and then eventually come back online. Occasionally, though, if the remote machine is having issues, the reboot can get hung up. If you try the command again, you will get the error: A system shutdown is in progress.(1115).
What now? Well, you can try cancelling the reboot with shutdown /a /m \\computername and initiate it again. You might try adding the /f switch to the shutdown /r command, which forces all running applications to exit rather than allowing them to save their data. But what if that doesn’t work either?
PSKill to the rescue. This tool is part of the excellent PSTools suite. Just unzip them to a folder in your path (like C:\Windows). We’re going to take advantage of a useful property of the Windows kernel: it depends on certain processes to be running at all times, and if one of these processes is terminated, the system will immediately reboot. One of these processes is winlogon.exe. Just issue this command:
pskill \\computername winlogon
Note that this is nearly the equivalent of pulling the plug on the machine. I wouldn’t recommend using it unless a regular reboot has failed. And of course if the machine isn’t responding to RPC, then nothing is going to work and you’ll just have to walk over there and mash that power button.
Was this helpful? Know of a better way? Leave a comment and let me know!
Comments
20 responses to “Unstick a remote reboot”
Ryan my man – thank you very much, just worked like a charm on a stuck Windows 2003 R2 Standard 32 bit server. Much appreciated!
Very helpful! Just what I needed to get my stuck Windows 2003 Enterprise 32 bit server reboot completed. Thanks a million!
worked really well – thanx
Saved my neck! I had no physical access for hours, was getting very nervous!
save my hind from going into the office at 2am. I owe you a beer. Thanks!
Worked for me! Windows 2003 Standard 2003 Server is 4300KM+ away on the other side of the country. Thanks man!
Exactly what I needed! I have used psexec a lot, but didn’t even pay attention to pskill. Thank you!
PSKill worked like a charm where everything else failed.
THANK YOU VERY MUCH!
This was awesome! Never thought to kill the winlogon process. Finally got that stupid server rebooted after hours.
Great article, thank you!!
Now, if you could tell me how to hit F1 remotely during startup!
Could not start PsKill service on computername:
A system shutdown is in progress.
(w2k8 r2)
Hmm, haven’t seen that myself. Maybe try a shutdown /a /m \\computername before running pskill?
THANK YOU!! Had a fax server that hung on me. Went on site and restarted it but left before waiting to see if it rebooted fully (I know, stupid of me.) Could ping the server but not access it via RDP. Had LogMeIn on it and could get to the Ctrl+ALT+del log in portion but Ctrl+ALT+del did not work. Could not pushing shutdown -r, shutdown -r -f to it. Nothing worked until I found this web page. Again, thank you!
Awesome post dude! Worked like a charm
Thanks Ryan for posting this tip.
It worked the first time I tried it, on a system that had hung during shutdown (while rebooting). Great! Wonderful!
I tried it a second time then the system was running normally. That was a bad idea because it caused a BSOD complaining that winlogon had died :-/. I had to wait until someone could stand in front of the system to power cycle it.
Lessons learned:
1) Always try shutdown (or psshutdown) first. Use psskill on winlogon only if the system is otherwise unresponsive.
2) Where budget allows, use a remote power cycle unit such as the NPS-3F15-1 Network Power Switc (https://www.wti.com/p-268-nps-3f15-1-network-power-switch-pdu-15a-120v-3nema-5-15r.aspx).
–klode
U R the best. you saved me…
Thanks
Very nice 🙂 I don’t know if pskill uses wmi or not, but some pstools use a different api and you can try killing processes through wmi api also if this doesn’t work with a tool like the built-in wmic
Something like wmic /node:computername process where “name like ‘winlogon.exe’” call Terminate
Might be the same wmi call though, i can’t say
pskill \\computername lsass. Been using it since the Sasser days..
Nothing I have tried works. pskill of either lsass or winlogon, rdp just fails (it shows dialog and goes away so fast I don’t see anything when I try), and shutdown reports the 1115 error. Short of power cycling, I have run out of options I can think of.
Thanks for this regardless!
Worked like a charm! Thanks a bunch!!