XP Pro Shutdown issue, with a twist -- any suggestions?

[evmiller]

I am the help desk slave at my office, and I support approx. 150 people. We run WinXP pro on HP DC5100 minitowers. 3GHz CPU, 80 GB HD, 1 GB RAM, 128 MB PCI Video Card added, internal sound chip used.

I have met up with a BIZARRE problem:

I have a user who's PC shuts down randomly. Sometimes it goes for days without shutting down, sometimes it shuts down multiple times in a day. No other user in the office has had this problem.

Here is the twist:

It is a GRACEFUL shutdown, not a *poof*-to-black shutdown. The user will be working, and all of a sudden, a message pops up that says that WinXP is shutting down in a minute or two. The user can not stop the shutdown from happening.

Here is what I have done so far in terms of troubleshooting:

1) Replaced the PC completely, ie, a brand new box -- TWICE! (The PCs were subsequently placed on other user's desks, and have not had a problem.)
2) Replaced the power cord.
3) Replaced the power strip.
4) Re-imaged the HDD.
5) Replaced the HDD.
6) Moved the power cord to another outlet inside the room.
7) Moved the power cord to another outlet in a different room.
8) Replaced the local printer and printer cable.
9) Replaced the keyboard and the mouse (separately).

At this point, other techs I work with are saying it could be static electricity. I doubt that could cause a graceful shutdown. But hey, I could be wrong.

Anybody out there have any ideas?

One very-close-to-postal IT tech...

E!

[DonBB]

It sounds like somebody is doing a remote shutdown of that particular user, especially since you've completely replaced the machine, and the same problem arises. Have you checked the Event Viewer? Is there anybody in the office that is savvy enough to know how to do a remote shutdown?

[evmiller]

I guess it is possible that one of the other techs or a network admin could be doing this, but it's doubtful. None of the users are savvy enough (to my knowledge) to do something like that. They are all lawyers, and can barely operate Outlook and WP without issues.

[DonBB]

Well, you've got two symptoms. You know it is central to the specific user, and to the specific location. You've ruled out the workstation and hardware itself because you've changed all of this out. If I understand correctly you use power strips, and not battery backups. I suppose this could possibly be caused by a drop in voltage at the specific AC outlet, but that's a long shot. Like I said, check the Event Viewer, if its not listed as an unexpected shutdown, or it there's no recovery after the shutdown, then in my eyes its gotta be a manual shutdown. The trick is now finding out where the shutdown is being executed from. It sounds to me like someone is enjoying watching you go through all this trouble with the workstation.