ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Windows Update: Rogue Reboot

    Scheduled Pinned Locked Moved Solved IT Discussion
    30 Posts 10 Posters 10.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • gjacobseG
      gjacobse
      last edited by scottalanmiller

      Windows Server 2012 R2 6.3.9600

      The process C:\Windows\system32\svchost.exe (Server1) has initiated the restart of computer Server1 
      on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Recovery (Planned)
       Reason Code: 0x80020002
       Shutdown Type: restart
       Comment: 
      

      So this happened at 9:23 EDT today.. we didn't okay it,.. and of course the client is a tad miffed. We got notification that it occurred...

      should this have happened? Could this have been prevented? Updates were run on it this past weekend,.. and rebooted.

      1 Reply Last reply Reply Quote 1
      • gjacobseG
        gjacobse
        last edited by

        Are some updates so 'critical' that Microsoft dictates automatic restart?

        ? 1 Reply Last reply Reply Quote 0
        • gjacobseG
          gjacobse
          last edited by

          Looking at the application log

          Successfully scheduled Software Protection service for re-start at 2115-07-07T13:14:44Z. 
          Reason: RulesEngine.
          
          1 Reply Last reply Reply Quote 0
          • ?
            A Former User @gjacobse
            last edited by

            @g.jacobse said:

            Are some updates so 'critical' that Microsoft dictates automatic restart?

            Depends on what Settings you push out via Group policy to prevent it. If you do nothing yes they can restart on their own.
            Also if it's a terminal/remote desktop server you need to completely lock out non-domain admins from accessing windows updates.

            1 Reply Last reply Reply Quote 0
            • W
              WingCreative
              last edited by

              Was anyone logged in through RDP or anything?

              Windows Server 2012 will do the automatic "You have 15 minutes until this thing restarts, you have no choice" thing just like it's Windows 8, but only if someone is actively logged into the server interface (AKA disconnected RDP sessions don't count).

              I know there was an out of band patch not too long ago, I don't know if you applied it and rebooted it with your maintenance last weekend but the combination of an important patch wanting to restart stuff + someone stepping away from an open RDP connection would cause something like this.

              1 Reply Last reply Reply Quote 0
              • gjacobseG
                gjacobse
                last edited by

                We had the notification that a reboot was needed post updates last weekend. AFAIK - no one was logged in. It's in New York and the local staff would not have had access to it.

                1 Reply Last reply Reply Quote 0
                • coliverC
                  coliver
                  last edited by

                  We had this happen to us and our primary SQL server last week (I think I mentioned here) same results unexpected reboot at basically the same time of day as you (right around 9:30AM).

                  I really need to deploy GPO settings to prevent or arrange automatic updates.

                  1 Reply Last reply Reply Quote 1
                  • ?
                    A Former User
                    last edited by

                    We push a server policy that forces the updates to download from WSUS but as Automatically Download but, let me chose when to install. If you don't choose when to install manually you'll end up with this stuff. I also have a GP to block non-domain admins from installing on all servers.

                    1 Reply Last reply Reply Quote 0
                    • gjacobseG
                      gjacobse
                      last edited by gjacobse

                      Just happened to find this from last night.

                      Windows update Update for Windows (KB3055343) requires a computer restart to complete the installation.
                      (Command line: "C:\Windows\system32\wusa.exe "C:\Program Files (x86)\DesktopCentral_Agent\\patches\101697-Windows8.1-KB3055343-v2-x64.msu" /quiet /norestart")
                      
                      1 Reply Last reply Reply Quote 0
                      • gjacobseG
                        gjacobse
                        last edited by

                        This is something that has been running through my brain all day...

                        And it just so happens that this update was released from MS on July 20.

                        We ran updates on the server on Sunday. and rebooted it then.

                        Why was it not installed then????

                        ? 1 Reply Last reply Reply Quote 1
                        • ?
                          A Former User @gjacobse
                          last edited by

                          @g.jacobse said:

                          This is something that has been running through my brain all day...

                          And it just so happens that this update was released from MS on July 20.

                          We ran updates on the server on Sunday. and rebooted it then.

                          Why was it not installed then????

                          But was it download at that point? and if you have WSUS was it approved at that point.

                          Also often times you need to install updates three or four times after reboots, some have prerequisites and some can't be installed with others.

                          JaredBuschJ 1 Reply Last reply Reply Quote 0
                          • JaredBuschJ
                            JaredBusch @A Former User
                            last edited by

                            @thecreativeone91 said:

                            @g.jacobse said:

                            This is something that has been running through my brain all day...

                            And it just so happens that this update was released from MS on July 20.

                            We ran updates on the server on Sunday. and rebooted it then.

                            Why was it not installed then????

                            But was it download at that point? and if you have WSUS was it approved at that point.

                            Also often times you need to install updates three or four times after reboots, some have prerequisites and some can't be installed with others.

                            Also, did the update have a dependency that was not there until after the Sunday reboot. Thus causing it to now be a needed update?

                            1 Reply Last reply Reply Quote 0
                            • gjacobseG
                              gjacobse
                              last edited by

                              Seems like this has come around again....

                              Server is receiving updates when the GPO is set to disable it.

                              1 Reply Last reply Reply Quote 0
                              • BRRABillB
                                BRRABill
                                last edited by

                                Hey @scottalanmiller here is an example of a random reboot! 🙂

                                1 Reply Last reply Reply Quote 1
                                • DashrenderD
                                  Dashrender
                                  last edited by

                                  I have users on a nearly monthly occasion complain that they they tell the system to remind in 10 mins or 4 hours, and yet the machine will just randomly reboot while they are working.

                                  BRRABillB 1 Reply Last reply Reply Quote 0
                                  • ntoxicatorN
                                    ntoxicator
                                    last edited by

                                    ive had similar issues

                                    Tried WSUS server through Group Policy. Never got it to work properly. gave it the finger.

                                    Turned windows updates off through GPO policy settings and to not bother user. Machines still at random will reboot without notice due to updates. Or updates will still get installed.

                                    Am I that incompetent?

                                    DashrenderD 1 Reply Last reply Reply Quote 0
                                    • gjacobseG
                                      gjacobse
                                      last edited by

                                      This goes with @art_of_shred thread:

                                      Can you stop a Windows DC from getting updates?

                                      1 Reply Last reply Reply Quote 0
                                      • BRRABillB
                                        BRRABill @Dashrender
                                        last edited by

                                        @Dashrender said:

                                        I have users on a nearly monthly occasion complain that they they tell the system to remind in 10 mins or 4 hours, and yet the machine will just randomly reboot while they are working.

                                        Are you using any sort of RMM product?

                                        gjacobseG 1 Reply Last reply Reply Quote 0
                                        • gjacobseG
                                          gjacobse @BRRABill
                                          last edited by

                                          @BRRABill said:

                                          @Dashrender said:

                                          I have users on a nearly monthly occasion complain that they they tell the system to remind in 10 mins or 4 hours, and yet the machine will just randomly reboot while they are working.

                                          Are you using any sort of RMM product?

                                          ManageEngine I believe might be on it,.. but updates are pushed manually.

                                          BRRABillB 1 Reply Last reply Reply Quote 0
                                          • BRRABillB
                                            BRRABill @gjacobse
                                            last edited by

                                            @gjacobse said:

                                            ManageEngine I believe might be on it,.. but updates are pushed manually.

                                            I asked because we use N-Able and they used to have an issue where the popup would show up, but it basically did nothing.

                                            Their code rewrote all the update stuff.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post