Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,289 questions
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hello. My server has been rebooted. I have determined why, but can't figure out the cause.
Get-EventLog -LogName System -After (Get-Date).AddDays(-3) |? {$_.EventID -in (6005,6006,6008,6009,1074,1076)} | ft TimeGenerated,EventId,Message -AutoSize -wrap
TimeGenerated EventID Message
------------- ------- -------
13.11.2024 19:49:01 6005 The Event log service was started.
13.11.2024 19:49:01 6009 Microsoft (R) Windows (R) 10.00. 17763 Multiprocessor Free.
13.11.2024 19:48:24 6006 The Event log service was stopped.
13.11.2024 19:48:00 1074 The process C:\Windows\system32\svchost.exe (MS-ADB) has initiated the restart of computer MS-ADB on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Servic
e pack (Planned)
Reason Code: 0x80020010
Shutdown Type: restart
Comment:
Get-HotFix | ft Description, InstalledOn -AutoSize
Description InstalledOn
----------- -----------
Update 13.11.2024 0:00:00
Security Update 07.09.2019 0:00:00
Security Update 14.04.2021 0:00:00
Security Update 23.12.2020 0:00:00
Update 21.09.2024 0:00:00
Security Update 14.04.2021 0:00:00
Security Update 21.02.2022 0:00:00
Security Update 13.11.2024 0:00:00
Security Update 30.01.2023 0:00:00
Security Update 04.04.2023 0:00:00
Security Update 21.09.2024 0:00:00
Security Update 11.10.2022 0:00:00
There was indeed an update installation. But I have a ban on automatic restart and installation:
Perhaps the update installation was initialized by a different administrator ? How to determine this ?