I work for a hospital and we had a 2003 server restart because of a Event ID 1111. The event properties are:
Driver Lexmark T652 required for printer !!luke!Z318 is unknown. Contact the administrator to install the driver before you log in again.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Now I checked and there's no printers installed on this server. I also went to Administrator Tools->Terminal Services Configuration->RDP-Tcp Properties. Then I went to the Client Settings tab and only the Audio mapping checkbox was checked.
We also had another random restart on this system about 2 hours before with an event ID of 6008. The event properties are:
The previous system shutdown at 4:59:58 AM on 4/1/2013 was unexpected.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
The VMware tools need to be updated on the system. I don't know if that would help with this issue. I just wanted to include this info on this post.