Why was the server reboot caused by installing the update ?

Андрей Михалевский 3,351 Reputation points
2024-11-14T09:31:41.97+00:00

Hello. My server has been rebooted. I have determined why, but can't figure out the cause.

Get-EventLog -LogName System -After (Get-Date).AddDays(-3) |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap

TimeGenerated       EventID Message                                                                                                                                                                                             

-------------       ------- -------                                                                                                                                                                                             

13.11.2024 19:49:01    6005 The Event log service was started.                                                                                                                                                                  

13.11.2024 19:49:01    6009 Microsoft (R) Windows (R) 10.00. 17763  Multiprocessor Free.                                                                                                                                        

13.11.2024 19:48:24    6006 The Event log service was stopped.                                                                                                                                                                  

13.11.2024 19:48:00    1074 The process C:\Windows\system32\svchost.exe (MS-ADB) has initiated the restart of computer MS-ADB on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Servic

                            e pack (Planned)                                                                                                                                                                                    

                             Reason Code: 0x80020010                                                                                                                                                                            

                             Shutdown Type: restart                                                                                                                                                                             

                             Comment:

Get-HotFix | ft Description, InstalledOn -AutoSize


Description     InstalledOn       
-----------     -----------       
Update          13.11.2024 0:00:00
Security Update 07.09.2019 0:00:00
Security Update 14.04.2021 0:00:00
Security Update 23.12.2020 0:00:00
Update          21.09.2024 0:00:00
Security Update 14.04.2021 0:00:00
Security Update 21.02.2022 0:00:00
Security Update 13.11.2024 0:00:00
Security Update 30.01.2023 0:00:00
Security Update 04.04.2023 0:00:00
Security Update 21.09.2024 0:00:00
Security Update 11.10.2022 0:00:00

There was indeed an update installation. But I have a ban on automatic restart and installation:

GPO

Perhaps the update installation was initialized by a different administrator ? How to determine this ?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,289 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,856 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.