Can you help solve the mystery of the rebooting VM?

\[SOLVED\]

Ok, so it's no Maltese Falcon, but it's giving me fits.

**Setup:** We have an HP Proliant tower running MS Server 2012 and Hyper-V, and a Server 2012 VM running on that which acts as a file server, DNS server, and VPN server. It sits behind a UBNT Edgerouter. The rest of the network is very simple, it's all connected to a single WAP.

**Issue:** For some reason, this VM keeps restarting. It happens maybe once or twice a day.

**On the host box:** I looked at the event logs (the application logs related to VMs), and nothing is happening there: It's not restarting, and it doesn't appear to be terminating the VM, at least as far as I can see: there are no errors, just informational stuff (eg "connecting to VM") at the time of the restart. So that makes me think the VM is restarting itself. I don't *think* it's restarting because of a missing heartbeat (though *I don't know how to absolutely confirm that part,* or change what it does when missing a VM heartbeat).

**On the VM itself**, the logs are... strange. The important stuff, the system logs, don't go back any further than the last boot-up. Other logs do, but the ones that might give me a clue what's going on don't seem to. It makes me wonder if instead of rebooting, the VM is just getting axed and restarted from a checkpoint or something? Unfortunately, it's been awhile since I've done much Hyper-V work; it's chugged along fine with no supervision for years, so I've very rusty.

**What's changed recently:** Well, I recently went in and changed our DHCP settings. For some reason we had both the router and the server both doing DHCP, with overlapping ranges, and this made me think it may be the cause of network glitches we get occasionally, so I removed the DHCP server role from the server, and now I've got the router doing all DHCP. Everything seems to be working (except for the restarts).

**So, to summarize:**

How do I figure out why this VM is restarting? Do the "missing" logs mean anything? Also, if this is an issue of Hyper-V restarting the VM because it's missing a heartbeat, does this mean that the VM is crashing, or could it be a networking issue?

Edit: Some progress. I found a dump that shows a crash in ntoskrnl.exe. This appears to be repeating in the other dumps as well. So the kernel itself of the VM is crashing.

Edit#2: Thanks everyone for your help! It looks like I figured it out. There was a scheduled task called ShadowCopyVolume that was causing the crash. Since we don't need the versioning feature, I disabled that task. Another r/sysadmin user informed me that this is a common issue with Webroot. I'm going to try altering that policy and see if this lets me re-enable that task.