Gosh don’t you just hate when this happens!!
Serious though to the issue….
This is caused by hardware or software (no brainer I know, but wait...).
• What was installed (hardware/software) before this happened?
• How long has this been happening?
• Does this only happen with this one user? What permissions do they have?
• Does this computer authenticate to a domain?
• What kind of domain? Windows, Novell, etc..
• Is the user nested in a group or outside the group?
• Are there scripts involved?
Most of these questions may have nothing to do with your issue, but it may? Why?
Well because it’s sporadic. These are always the worst kind of problems to trouble shoot.
I bet if you tried to read the dump it was Greek to you, unless you are Greek then its Spanish!...
The “Event ID” number is generated by the software or hardware it’s self and not by Windows, this is why you were really unable to locate it on the web.
Cheesy guess on my part but I feel it is either a TAPI or TCP/IP issue, Why?
Binding, when it breaks it blows up.
Have you done anything in these areas? Does any of the bulleted area’s look like they may come into play?
Try logging on as the local admin on the local box, DO NOT log in to a domain.
When you log into a domain it is very possible for it to run scripts, this may be where the issue lies? What happens? If it still does it then look for anything that would bind such as firewall, anti virus, fax, modem POS, etc… software. You may even need to uninstall and reinstall TAPI and TCP/IP stack.
Now I could be way of base on what is causing it but the theory is true.
Find a point when it was working, uninstall one at a time any hardware, software or patches that was applied. Have beer? It could be a long night…
When it reboots does it 'just reboot', or does it give you a quick blue screen (different from the old win9x blue screens),.. since you said you looked at event log i'll assume its win2k / xp. This usually means a hardware error (was the motherboard in my case).
When it shuts down does it give you a little dialog box saying something like 'The Remote Procedure Call service has been shutdown etc etc'.. or 'LSASS.exe has shutdown unexpectedly'.. they then give you a nice 1 minute to clean up before it automatically reboots.