locked
Server restart every night at 3AM by Windows Update even if there is no Update to install or reboot pending RRS feed

  • Question

  • Hello,

    In facing from some time with strange behaviour of my Server.

    I have domain environment with new WSUS Server on 2008 R2. All machine get update from this and works fine. From some time I see my 5 from 9 Server restart every night at 3AM. This reboot is initiated by WU. This Server is fully patched and have no new path to install. I also check registry to see is there RebotPending key in Windows Update but no.

    In EventViever I found this entry:

    Proces C:\Windows\System32\svchost.exe (Computer Name) zainicjował zamknięcie  komputera Computer Name w imieniu użytkownika ZARZĄDZANIE NT\SYSTEM z następującej przyczyny: Inne zadania (zaplanowane)
     Kod przyczyny: 0x80000000
     Typ zamknięcia systemu: zamknięcie
     Komentarz: User initiated

    I also attache WindowsUpdatelog bellow:

    2017-05-15    09:09:21:069    1072    ac8    AU    Triggering AU detection through DetectNow API
    2017-05-15    09:09:21:069    1072    ac8    AU    Triggering Online detection (interactive)
    2017-05-15    09:09:21:069    1072    1180    AU    #############
    2017-05-15    09:09:21:069    1072    1180    AU    ## START ##  AU: Search for updates
    2017-05-15    09:09:21:069    1072    1180    AU    #########
    2017-05-15    09:09:21:069    1072    1180    AU    <<## SUBMITTED ## AU: Search for updates [CallId = {F4D40CB7-8A1D-4B9F-A04E-3E1903AB5A32}]
    2017-05-15    09:09:21:069    1072    1460    Agent    *************
    2017-05-15    09:09:21:069    1072    1460    Agent    ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2017-05-15    09:09:21:069    1072    1460    Agent    *********
    2017-05-15    09:09:21:069    1072    1460    Agent      * Online = Yes; Ignore download priority = No
    2017-05-15    09:09:21:069    1072    1460    Agent      * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
    2017-05-15    09:09:21:069    1072    1460    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2017-05-15    09:09:21:069    1072    1460    Agent      * Search Scope = {Machine}
    2017-05-15    09:09:21:069    1072    1460    Setup    Checking for agent SelfUpdate
    2017-05-15    09:09:21:069    1072    1460    Setup    Client version: Core: 7.6.7601.23735  Aux: 7.6.7601.23735
    2017-05-15    09:09:21:069    1072    1460    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080:
    2017-05-15    09:09:21:178    1072    1460    Misc     Microsoft signed: NA
    2017-05-15    09:09:21:178    1072    1460    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\TMP1D55.tmp with dwProvFlags 0x00000080:
    2017-05-15    09:09:21:240    1072    1460    Misc     Microsoft signed: NA
    2017-05-15    09:09:21:240    1072    1460    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2017-05-15    09:09:21:256    1072    1460    Misc     Microsoft signed: NA
    2017-05-15    09:09:21:272    1072    1460    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2017-05-15    09:09:21:303    1072    1460    Misc     Microsoft signed: NA
    2017-05-15    09:09:21:319    1072    1460    Setup    Determining whether a new setup handler needs to be downloaded
    2017-05-15    09:09:21:319    1072    1460    Setup    SelfUpdate handler is not found.  It will be downloaded
    2017-05-15    09:09:21:319    1072    1460    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-15    09:09:21:319    1072    1460    Setup    Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-15    09:09:21:319    1072    1460    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-15    09:09:21:350    1072    1460    Setup    Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-15    09:09:21:350    1072    1460    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-15    09:09:21:397    1072    1460    Setup    Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-15    09:09:21:397    1072    1460    Setup    SelfUpdate check completed.  SelfUpdate is NOT required.
    2017-05-15    09:09:21:694    1072    1460    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
    2017-05-15    09:09:21:694    1072    1460    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ClientWebService/client.asmx
    2017-05-15    09:09:45:678    1072    1460    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2017-05-15    09:09:45:678    1072    1460    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ClientWebService/client.asmx
    2017-05-15    09:09:45:912    1072    1460    Agent      * Found 0 updates and 79 categories in search; evaluated appl. rules of 1156 out of 2384 deployed entities
    2017-05-15    09:09:45:912    1072    1460    Agent    *********
    2017-05-15    09:09:45:912    1072    1460    Agent    **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2017-05-15    09:09:45:912    1072    1460    Agent    *************
    2017-05-15    09:09:45:912    1072    10c    AU    >>##  RESUMED  ## AU: Search for updates [CallId = {F4D40CB7-8A1D-4B9F-A04E-3E1903AB5A32}]
    2017-05-15    09:09:45:912    1072    10c    AU      # 0 updates detected
    2017-05-15    09:09:45:912    1072    10c    AU    #########
    2017-05-15    09:09:45:912    1072    10c    AU    ##  END  ##  AU: Search for updates [CallId = {F4D40CB7-8A1D-4B9F-A04E-3E1903AB5A32}]
    2017-05-15    09:09:45:912    1072    10c    AU    #############
    2017-05-15    09:09:45:912    1072    10c    AU    Successfully wrote event for AU health state:0
    2017-05-15    09:09:45:912    1072    10c    AU    Featured notifications is disabled.
    2017-05-15    09:09:45:912    1072    10c    AU    AU setting next detection timeout to 2017-05-16 04:38:57
    2017-05-15    09:09:45:912    1072    10c    AU    Setting AU scheduled install time to 2017-05-15 16:00:00
    2017-05-15    09:09:45:912    1072    10c    AU    Successfully wrote event for AU health state:0
    2017-05-15    09:09:45:912    1072    10c    AU    Successfully wrote event for AU health state:0
    2017-05-15    09:09:50:912    1072    1460    Report    REPORT EVENT: {E2D65959-770E-431E-B856-85276836221A}    2017-05-15 09:09:45:912+0200    1    147    101    {00000000-0000-0000-0000-000000000000}    0    0    AutomaticUpdates    Success    Software Synchronization    Windows Update Client successfully detected 0 updates.
    2017-05-15    09:09:50:912    1072    1460    Report    REPORT EVENT: {7BDD6391-C98F-4616-8ED0-F7AFC47B7BB2}    2017-05-15 09:09:45:912+0200    1    156    101    {00000000-0000-0000-0000-000000000000}    0    0    AutomaticUpdates    Success    Pre-Deployment Check    Reporting client status.
    2017-05-15    09:17:36:459    1072    1460    Report    Uploading 4 events using cached cookie, reporting URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ReportingWebService/ReportingWebService.asmx
    2017-05-15    09:17:36:475    1072    1460    Report    Reporter successfully uploaded 4 events.
    2017-05-15    15:06:49:006    1072    1180    AU    AU setting next sqm report timeout to 2017-05-16 13:06:49
    2017-05-15    18:00:10:006    1072    1180    AU    Forced install timer expired for AUInstallType = 4
    2017-05-15    18:00:10:006    1072    1180    AU    UpdateDownloadProperties: 0 download(s) are still in progress.
    2017-05-15    18:00:10:006    1072    1180    AU    Setting AU scheduled install time to 2017-05-16 16:00:00
    2017-05-15    18:00:10:006    1072    1180    AU    Successfully wrote event for AU health state:0
    2017-05-16    03:00:24:131    1072    1180    AU    Initiating Install-at-shutdown
    2017-05-16    03:00:24:131    1072    1180    Shutdwn    user declined update at shutdown
    2017-05-16    03:00:24:131    1072    1180    AU    Successfully wrote event for AU health state:0
    2017-05-16    03:00:24:131    1072    1180    AU    AU initiates service shutdown
    2017-05-16    03:00:24:131    1072    1180    AU    ###########  AU: Uninitializing Automatic Updates  ###########
    2017-05-16    03:00:25:241    1072    1180    Service    *********
    2017-05-16    03:00:25:241    1072    1180    Service    **  END  **  Service: Service exit [Exit code = 0x240001]
    2017-05-16    03:00:25:241    1072    1180    Service    *************
    2017-05-16    03:04:24:978    1052    cec    Misc    ===========  Logging initialized (build: 7.6.7601.23735, tz: +0200)  ===========
    2017-05-16    03:04:25:040    1052    cec    Misc      = Process: C:\Windows\system32\svchost.exe
    2017-05-16    03:04:25:056    1052    cec    Misc      = Module: c:\windows\system32\wuaueng.dll
    2017-05-16    03:04:24:978    1052    cec    Service    *************
    2017-05-16    03:04:25:103    1052    cec    Service    ** START **  Service: Service startup
    2017-05-16    03:04:25:103    1052    cec    Service    *********
    2017-05-16    03:04:25:478    1052    cec    Agent      * WU client version 7.6.7601.23735
    2017-05-16    03:04:25:478    1052    cec    Agent      * Base directory: C:\Windows\SoftwareDistribution
    2017-05-16    03:04:25:478    1052    cec    Agent      * Access type: No proxy
    2017-05-16    03:04:25:478    1052    cec    Agent      * Network state: Connected
    2017-05-16    03:05:11:025    1052    cec    Report    CWERReporter::Init succeeded
    2017-05-16    03:05:11:025    1052    cec    Agent    ***********  Agent: Initializing Windows Update Agent  ***********
    2017-05-16    03:05:11:040    1052    cec    Agent      * Prerequisite roots succeeded.
    2017-05-16    03:05:11:040    1052    cec    Agent    ***********  Agent: Initializing global settings cache  ***********
    2017-05-16    03:05:11:040    1052    cec    Agent      * WSUS server: http://4110-SSSDHCP01.ad.ms.gov.pl:8530
    2017-05-16    03:05:11:040    1052    cec    Agent      * WSUS status server: http://4110-SSSDHCP01.ad.ms.gov.pl:8530
    2017-05-16    03:05:11:040    1052    cec    Agent      * Target group: (Unassigned Computers)
    2017-05-16    03:05:11:040    1052    cec    Agent      * Windows Update access disabled: No
    2017-05-16    03:05:11:040    1052    cec    DnldMgr    Download manager restoring 0 downloads
    2017-05-16    03:05:11:040    1052    cec    AU    ###########  AU: Initializing Automatic Updates  ###########
    2017-05-16    03:05:11:040    1052    cec    AU      # WSUS server: http://4110-SSSDHCP01.ad.ms.gov.pl:8530
    2017-05-16    03:05:11:040    1052    cec    AU      # Detection frequency: 22
    2017-05-16    03:05:11:040    1052    cec    AU      # Approval type: Scheduled (Policy)
    2017-05-16    03:05:11:040    1052    cec    AU      # Scheduled install day/time: Every day at 18:00
    2017-05-16    03:05:11:040    1052    cec    AU      # Auto-install minor updates: Yes (User preference)
    2017-05-16    03:05:11:040    1052    cec    AU      # Will interact with non-admins (Non-admins are elevated (User preference))
    2017-05-16    03:05:11:056    1052    cec    AU    Setting AU scheduled install time to 2017-05-16 16:00:00
    2017-05-16    03:05:11:306    1052    cec    Report    ***********  Report: Initializing static reporting data  ***********
    2017-05-16    03:05:11:306    1052    cec    Report      * OS Version = 6.1.7601.1.0.65792
    2017-05-16    03:05:11:306    1052    cec    Report      * OS Product Type = 0x00000030
    2017-05-16    03:05:11:337    1052    cec    Report      * Computer Brand = Microsoft Corporation
    2017-05-16    03:05:11:337    1052    cec    Report      * Computer Model = Virtual Machine
    2017-05-16    03:05:11:337    1052    cec    Report      * Bios Revision = 090006
    2017-05-16    03:05:11:337    1052    cec    Report      * Bios Name = BIOS Date: 05/23/12 17:15:53  Ver: 09.00.06
    2017-05-16    03:05:11:337    1052    cec    Report      * Bios Release Date = 2012-05-23T00:00:00
    2017-05-16    03:05:11:337    1052    cec    Report      * Locale ID = 1045
    2017-05-16    03:05:11:525    1052    cec    AU    Successfully wrote event for AU health state:0
    2017-05-16    03:05:11:525    1052    cec    AU    Initializing featured updates
    2017-05-16    03:05:11:525    1052    cec    AU    Found 0 cached featured updates
    2017-05-16    03:05:11:525    1052    cec    AU    Successfully wrote event for AU health state:0
    2017-05-16    03:05:11:525    1052    cec    AU    Successfully wrote event for AU health state:0
    2017-05-16    03:05:11:525    1052    cec    AU    AU finished delayed initialization
    2017-05-16    06:38:57:009    1052    cec    AU    #############
    2017-05-16    06:38:57:009    1052    cec    AU    ## START ##  AU: Search for updates
    2017-05-16    06:38:57:009    1052    cec    AU    #########
    2017-05-16    06:38:57:040    1052    cec    AU    <<## SUBMITTED ## AU: Search for updates [CallId = {AB97C51C-3F1A-4419-9397-3AE22AE5FA7C}]
    2017-05-16    06:38:57:040    1052    ef8    Agent    *************
    2017-05-16    06:38:57:040    1052    ef8    Agent    ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2017-05-16    06:38:57:040    1052    ef8    Agent    *********
    2017-05-16    06:38:57:040    1052    ef8    Agent      * Online = Yes; Ignore download priority = No
    2017-05-16    06:38:57:040    1052    ef8    Agent      * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
    2017-05-16    06:38:57:040    1052    ef8    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2017-05-16    06:38:57:040    1052    ef8    Agent      * Search Scope = {Machine}
    2017-05-16    06:38:57:103    1052    ef8    Setup    Checking for agent SelfUpdate
    2017-05-16    06:38:57:103    1052    ef8    Setup    Client version: Core: 7.6.7601.23735  Aux: 7.6.7601.23735
    2017-05-16    06:38:57:150    1052    ef8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080:
    2017-05-16    06:38:57:400    1052    ef8    Misc     Microsoft signed: NA
    2017-05-16    06:38:57:400    1052    ef8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\TMP20AF.tmp with dwProvFlags 0x00000080:
    2017-05-16    06:38:57:525    1052    ef8    Misc     Microsoft signed: NA
    2017-05-16    06:38:57:540    1052    ef8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2017-05-16    06:38:57:556    1052    ef8    Misc     Microsoft signed: NA
    2017-05-16    06:38:57:572    1052    ef8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2017-05-16    06:38:57:603    1052    ef8    Misc     Microsoft signed: NA
    2017-05-16    06:38:57:634    1052    ef8    Setup    Determining whether a new setup handler needs to be downloaded
    2017-05-16    06:38:57:634    1052    ef8    Setup    SelfUpdate handler is not found.  It will be downloaded
    2017-05-16    06:38:57:634    1052    ef8    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-16    06:38:58:728    1052    ef8    Setup    Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-16    06:38:58:728    1052    ef8    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-16    06:38:58:759    1052    ef8    Setup    Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-16    06:38:58:759    1052    ef8    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-16    06:38:58:806    1052    ef8    Setup    Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-16    06:38:58:806    1052    ef8    Setup    SelfUpdate check completed.  SelfUpdate is NOT required.
    2017-05-16    06:38:59:368    1052    ef8    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
    2017-05-16    06:38:59:368    1052    ef8    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ClientWebService/client.asmx
    2017-05-16    06:38:59:415    1052    ef8    PT    WARNING: Cached cookie has expired or new PID is available
    2017-05-16    06:38:59:415    1052    ef8    PT    Initializing simple targeting cookie, clientId = 969bfc62-cad0-412b-936b-4d7555d4d332, target group = , DNS name = rak
    2017-05-16    06:38:59:415    1052    ef8    PT      Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/SimpleAuthWebService/SimpleAuth.asmx
    2017-05-16    06:39:31:447    1052    ef8    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2017-05-16    06:39:31:447    1052    ef8    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ClientWebService/client.asmx
    2017-05-16    06:39:31:978    1052    ef8    Agent      * Found 0 updates and 79 categories in search; evaluated appl. rules of 1156 out of 2384 deployed entities
    2017-05-16    06:39:31:993    1052    ef8    Agent    *********
    2017-05-16    06:39:31:993    1052    ef8    Agent    **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2017-05-16    06:39:31:993    1052    ef8    Agent    *************
    2017-05-16    06:39:31:993    1052    c98    AU    >>##  RESUMED  ## AU: Search for updates [CallId = {AB97C51C-3F1A-4419-9397-3AE22AE5FA7C}]
    2017-05-16    06:39:31:993    1052    c98    AU      # 0 updates detected
    2017-05-16    06:39:31:993    1052    c98    AU    #########
    2017-05-16    06:39:31:993    1052    c98    AU    ##  END  ##  AU: Search for updates [CallId = {AB97C51C-3F1A-4419-9397-3AE22AE5FA7C}]
    2017-05-16    06:39:31:993    1052    c98    AU    #############
    2017-05-16    06:39:31:993    1052    c98    AU    Successfully wrote event for AU health state:0
    2017-05-16    06:39:31:993    1052    c98    AU    Featured notifications is disabled.
    2017-05-16    06:39:31:993    1052    c98    AU    AU setting next detection timeout to 2017-05-17 01:01:09
    2017-05-16    06:39:31:993    1052    c98    AU    Setting AU scheduled install time to 2017-05-16 16:00:00
    2017-05-16    06:39:31:993    1052    c98    AU    Successfully wrote event for AU health state:0
    2017-05-16    06:39:32:009    1052    c98    AU    Successfully wrote event for AU health state:0
    2017-05-16    06:39:36:993    1052    ef8    Report    REPORT EVENT: {156C88AE-C341-456F-9C24-8CD3EE5ECF6A}    2017-05-16 06:39:31:993+0200    1    147    101    {00000000-0000-0000-0000-000000000000}    0    0    AutomaticUpdates    Success    Software Synchronization    Windows Update Client successfully detected 0 updates.
    2017-05-16    06:39:36:993    1052    ef8    Report    REPORT EVENT: {305472AE-9FEF-4CA7-9B52-DC5BD30A2F66}    2017-05-16 06:39:31:993+0200    1    156    101    {00000000-0000-0000-0000-000000000000}    0    0    AutomaticUpdates    Success    Pre-Deployment Check    Reporting client status.
    2017-05-16    06:50:06:103    1052    ef8    Report    Uploading 2 events using cached cookie, reporting URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ReportingWebService/ReportingWebService.asmx
    2017-05-16    06:50:06:118    1052    ef8    Report    Reporter successfully uploaded 2 events.
    2017-05-16    08:19:05:759    1052    b54    AU    ###########  AU: Setting new AU options  ###########
    2017-05-16    08:19:05:759    1052    b54    AU    Successfully wrote event for AU health state:0
    2017-05-16    08:19:05:759    1052    b54    AU      # Policy changed, AU refresh required = No
    2017-05-16    08:19:05:759    1052    b54    AU      # WSUS server: http://4110-SSSDHCP01.ad.ms.gov.pl:8530
    2017-05-16    08:19:05:759    1052    b54    AU      # Detection frequency: 22
    2017-05-16    08:19:05:759    1052    b54    AU      # Approval type: Scheduled (Policy)
    2017-05-16    08:19:05:759    1052    b54    AU      # Scheduled install day/time: Every day at 18:00
    2017-05-16    08:19:05:759    1052    b54    AU      # Auto-install minor updates: Yes (User preference)
    2017-05-16    08:19:05:759    1052    b54    AU      # Will interact with non-admins (Non-admins are elevated (User preference))
    2017-05-16    08:19:05:759    1052    b54    AU    AU settings changed through User Preference.
    2017-05-16    08:19:05:759    1052    b54    AU    Setting AU scheduled install time to 2017-05-16 16:00:00
    2017-05-16    08:19:05:759    1052    b54    AU    Successfully wrote event for AU health state:0
    2017-05-16    08:19:05:775    1052    b54    AU    Successfully wrote event for AU health state:0
    2017-05-16    08:19:11:134    1052    b54    AU    Triggering AU detection through DetectNow API
    2017-05-16    08:19:11:134    1052    b54    AU    Triggering Online detection (interactive)
    2017-05-16    08:19:11:134    1052    cec    AU    #############
    2017-05-16    08:19:11:150    1052    cec    AU    ## START ##  AU: Search for updates
    2017-05-16    08:19:11:150    1052    cec    AU    #########
    2017-05-16    08:19:11:150    1052    cec    AU    <<## SUBMITTED ## AU: Search for updates [CallId = {A593FD90-7AB2-4FED-BB9E-C6FCB4ABF3F8}]
    2017-05-16    08:19:11:150    1052    11a8    Agent    *************
    2017-05-16    08:19:11:150    1052    11a8    Agent    ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2017-05-16    08:19:11:150    1052    11a8    Agent    *********
    2017-05-16    08:19:11:150    1052    11a8    Agent      * Online = Yes; Ignore download priority = No
    2017-05-16    08:19:11:150    1052    11a8    Agent      * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
    2017-05-16    08:19:11:150    1052    11a8    Agent      * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2017-05-16    08:19:11:150    1052    11a8    Agent      * Search Scope = {Machine}
    2017-05-16    08:19:11:150    1052    11a8    Setup    Checking for agent SelfUpdate
    2017-05-16    08:19:11:150    1052    11a8    Setup    Client version: Core: 7.6.7601.23735  Aux: 7.6.7601.23735
    2017-05-16    08:19:11:181    1052    11a8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080:
    2017-05-16    08:19:11:368    1052    11a8    Misc     Microsoft signed: NA
    2017-05-16    08:19:11:368    1052    11a8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\TMPE4C1.tmp with dwProvFlags 0x00000080:
    2017-05-16    08:19:11:447    1052    11a8    Misc     Microsoft signed: NA
    2017-05-16    08:19:11:462    1052    11a8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2017-05-16    08:19:11:462    1052    11a8    Misc     Microsoft signed: NA
    2017-05-16    08:19:11:493    1052    11a8    Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2017-05-16    08:19:11:509    1052    11a8    Misc     Microsoft signed: NA
    2017-05-16    08:19:11:525    1052    11a8    Setup    Determining whether a new setup handler needs to be downloaded
    2017-05-16    08:19:11:525    1052    11a8    Setup    SelfUpdate handler is not found.  It will be downloaded
    2017-05-16    08:19:11:525    1052    11a8    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-16    08:19:12:509    1052    11a8    Setup    Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-16    08:19:12:509    1052    11a8    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-16    08:19:12:540    1052    11a8    Setup    Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-16    08:19:12:540    1052    11a8    Setup    Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2017-05-16    08:19:12:572    1052    11a8    Setup    Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is not applicable
    2017-05-16    08:19:12:572    1052    11a8    Setup    SelfUpdate check completed.  SelfUpdate is NOT required.
    2017-05-16    08:19:13:900    1052    11a8    PT    +++++++++++  PT: Synchronizing server updates  +++++++++++
    2017-05-16    08:19:13:900    1052    11a8    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ClientWebService/client.asmx
    2017-05-16    08:19:13:962    1052    11a8    PT    WARNING: Cached cookie has expired or new PID is available
    2017-05-16    08:19:13:962    1052    11a8    PT    Initializing simple targeting cookie, clientId = 969bfc62-cad0-412b-936b-4d7555d4d332, target group = , DNS name = rak
    2017-05-16    08:19:13:962    1052    11a8    PT      Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/SimpleAuthWebService/SimpleAuth.asmx
    2017-05-16    08:19:45:306    1052    11a8    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2017-05-16    08:19:45:306    1052    11a8    PT      + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://4110-SSSDHCP01.ad.ms.gov.pl:8530/ClientWebService/client.asmx
    2017-05-16    08:19:45:540    1052    11a8    Agent      * Found 0 updates and 79 categories in search; evaluated appl. rules of 1156 out of 2384 deployed entities
    2017-05-16    08:19:45:540    1052    11a8    Agent    *********
    2017-05-16    08:19:45:540    1052    11a8    Agent    **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2017-05-16    08:19:45:540    1052    11a8    Agent    *************
    2017-05-16    08:19:45:556    1052    12b0    AU    >>##  RESUMED  ## AU: Search for updates [CallId = {A593FD90-7AB2-4FED-BB9E-C6FCB4ABF3F8}]
    2017-05-16    08:19:45:556    1052    12b0    AU      # 0 updates detected
    2017-05-16    08:19:45:556    1052    12b0    AU    #########
    2017-05-16    08:19:45:556    1052    12b0    AU    ##  END  ##  AU: Search for updates [CallId = {A593FD90-7AB2-4FED-BB9E-C6FCB4ABF3F8}]
    2017-05-16    08:19:45:556    1052    12b0    AU    #############
    2017-05-16    08:19:45:556    1052    12b0    AU    Successfully wrote event for AU health state:0
    2017-05-16    08:19:45:556    1052    12b0    AU    Featured notifications is disabled.
    2017-05-16    08:19:45:556    1052    12b0    AU    AU setting next detection timeout to 2017-05-17 01:47:53
    2017-05-16    08:19:45:556    1052    12b0    AU    Setting AU scheduled install time to 2017-05-16 16:00:00
    2017-05-16    08:19:45:556    1052    12b0    AU    Successfully wrote event for AU health state:0
    2017-05-16    08:19:45:556    1052    12b0    AU    Successfully wrote event for AU health state:0
    2017-05-16    08:19:50:540    1052    11a8    Report    REPORT EVENT: {4C0D427B-1047-492F-847B-D67FD1039867}    2017-05-16 08:19:45:540+0200    1    147    101    {00000000-0000-0000-0000-000000000000}    0    0    AutomaticUpdates    Success    Software Synchronization    Windows Update Client successfully detected 0 updates.
    2017-05-16    08:19:50:540    1052    11a8    Report    REPORT EVENT: {C39A6DB6-6BEC-44AB-BA77-BCAED326EAE7}    2017-05-16 08:19:45:540+0200    1    156    101    {00000000-0000-0000-0000-000000000000}    0    0    AutomaticUpdates    Success    Pre-Deployment Check    Reporting client status.

    I don't see reson for this behavior and can't finde solution to resolve this.

    Tuesday, May 16, 2017 7:06 AM

All replies

  • Hi,
    How do you determine that the reboot is initiated by WU?
    And in my opinion, I would suggest you go to check if there is scheduled task or script which is set up to reboot sever.

    In addition, computer reboot could be caused by various reasons, have you checked if the servers are all running in good health? In my experience, you could also take a look at power supply, anti-virus etc.
    Best regards, 
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Wednesday, May 17, 2017 2:20 AM
  • Hi,

    I believe this:

    2017-05-16    03:00:24:131    1072    1180    AU    Initiating Install-at-shutdown
    2017-05-16    03:00:24:131    1072    1180    Shutdwn    user declined update at shutdown
    2017-05-16    03:00:24:131    1072    1180    AU    Successfully wrote event for AU health state:0
    2017-05-16    03:00:24:131    1072    1180    AU    AU initiates service shutdown

    and this at 3:00 AM:

    Proces C:\Windows\System32\svchost.exe (Computer Name) zainicjował zamknięcie  komputera Computer Name w imieniu użytkownika ZARZĄDZANIE NT\SYSTEM z następującej przyczyny: Inne zadania (zaplanowane)
     Kod przyczyny: 0x80000000
     Typ zamknięcia systemu: zamknięcie (Shutdown)
     Komentarz: User initiated

    clearly put this behaviour to Windows Update.

    All this machine is VM and some of it don't have even installed antivirus. There also is no scheduled task on this hour. So I think this problem is witch WU.

    Wednesday, May 17, 2017 6:59 AM
  • Hi,
    Please check the "View update history" in the windows update of computer to see if there are really no updates insatlled or not.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Friday, May 19, 2017 1:20 PM
  • Hi,

    when I trying to resolve this issue I delete all Software Distribution directory so now I have nothing in WU History.

    Friday, May 19, 2017 1:30 PM
  • Hi Marcin,

    Is the issue solved ? If not, try checking the registry if the update settings are not wrong.

    HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU

    AUOptions should be 2, 3 or 5 other than 4 if you don't want to automatically install updates & reboot the server.

    • Proposed as answer by Wendy Jiang Friday, May 26, 2017 12:34 PM
    Saturday, May 20, 2017 7:02 PM
  • Hi,

    I am checking how the issue is going, if you still have any questions, please feel free to contact us.

    And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question.

    Appreciate for your feedback.
    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Friday, May 26, 2017 12:35 PM