Windows updates... auto restart when it shouldn't


  • I have my client PCs Window Updates set to "Check for updates but let me choose whether to download and install them" So that they don't restart on me me unexpectedly.

    However I apparently had one set to "Download updates but let me choose whether to install them."  Which I admit I thought would also keep the system from restarting on it's own.  However logs show that last night at 11:23pm the system went down and didn't come back up until 6:55am.  Windoows update shows updates were installed at 11:20pm.

    First problem, no one authorized the installation of updates, I know this because I'm the only one who does that, second no one was around to do it.

    Second problem, why did the restart take almost 7 and a half hours?  There isn't any software running on that particular PC that could cause a delay like that.

    This has happened on occasion in the past, but it's never been down for more than a few minutes, usually not even long enough for me to get a notification of it being offline.

    • Edited by fordag Friday, February 17, 2012 3:29 PM
    Friday, February 17, 2012 3:19 PM


All replies

  • Not sure what could have gone wrong for your user, but I always set my systems to Download updates but let me choose whether to install them and I've never had one restart on its own unexpectedly because of the Windows Update.  Never once.

    Is it possible that for some reason unrelated to the Windows Updates the system was instructed to shut down?  Seems to me on certain types of shutdown if you've already downloaded the updates they'll try to go in automatically at that time.

    Regarding why it should take a long time to come back up...  No idea.  Just some random thoughts:  Does that system restart quickly under normal conditions?  Is it possible something was running that really did take forever and a day to quit, thus allowing the shutdown to continue?  Is it possible the disk was corrupted and required a CHKDSK on restart?  Could it have been a shutdown rather than a restart, and the system is configured to wake on LAN or maybe there was a power hit that caused it to start up again?

    What's in the Windows logs?



    Detailed how-to in my new eBook: Configure The Windows 7 "To Work" Options

    • Edited by Noel Carboni Friday, February 17, 2012 10:09 PM added a couple more ideas
    Friday, February 17, 2012 10:08 PM
  • I checked the system logs and the reason for the shutdown is given as other

    The process Explorer.EXE has initiated the shutdown of computer KITCHEN on behalf of user KITCHEN\kitchen win7 for the following reason: Other (Unplanned)
     Reason Code: 0x0
     Shutdown Type: shutdown

    So it looks like a user initiated shutdown.  However it's been sworn to me on a bible that no one shut down the system and no one restarted it the next day...

    So it's possible the shutdown prompted the Updates. and it just looked like the updates did because they ran at that time.

    What should I look for in the Event Log?  If the user swears he didn't shut the machine down (and for the moment I believe him) what should I be on the lookout for leading up to or after the shutdown?

    Saturday, February 18, 2012 9:46 PM
  • That's a good question.  I'm not really sure what else you could look for.  Maybe they installed something that required a shutdown and they just didn't remember doing so?  Only thing I would suggest is looking at all other events in the other logs at just that time.

    This won't help with diagnosis after the fact, but one thing I do via the group policy editor is to configure the Shutdown Event Tracker to come up on user initiated shutdowns.  The setting is in Computer Configuration > Administrative Templates > System, and the entry to enable is called Display Shutdown Event Tracker.  I set it to Enabled, Always.  Then whenever a user initiates a shutdown (even if accidentally by fat-fingering the start menu or something) it will pop up the following dialog:


    Like I said, this won't help you with this instance, but could help you better track shutdowns in the future.



    Detailed how-to in my new eBook: Configure The Windows 7 "To Work" Options

    Saturday, February 18, 2012 10:14 PM
  • From my research on my computer at home, Windows 7 Professional SP1 64 bit, I gather that you can't run the Shutdown Event Tracker on a PC with only an Administrator log in.

    Is that correct?

    Sunday, February 19, 2012 3:02 AM
  • Not sure I understand your usage of "only an Administrator log in"...  I am logging into my system as the sole administrator, and it works okay.

    What's it doing that you didn't expect, or not doing that you did?


    Detailed how-to in my new eBook: Configure The Windows 7 "To Work" Options

    Sunday, February 19, 2012 3:29 AM
  • At this particular client's location he simply has 9 individual PC's on a home network.  He does not have a Windows server.   Each PC has only the administrator log in, since he's generally the only one who uses them.

    When I went into the Local Group Policy Editor under Local Computer Policy>Computer Configuration>Administrative Templates>System  there is no option for Display Shutdown Event Tracker.

    Sunday, February 19, 2012 3:59 AM
  • Interesting.  Perhaps it's something only available on Ultimate?  This machine is on a simple network with no server as well:

    Make sure you sort the list by name just to be sure.


    Detailed how-to in my new eBook: Configure The Windows 7 "To Work" Options

    • Marked as answer by fordag Sunday, February 19, 2012 4:31 AM
    Sunday, February 19, 2012 4:27 AM
  • Ahh, the screen shot did it, I had simply expanded the System folder and did not see a sub folder.  I hadn't looked in the Systen folder for an individual event item. 

    Thanks, that was very helpful.  It's enabled now on my Home PC so I can try it out and I'll enable it on my client's machines as well.

    Sunday, February 19, 2012 4:31 AM
  • I've seen this occur for no apparent reason on a Windows 7 Enterprise 32-bit machine. Any other ideas what this is?
    Thursday, June 07, 2012 9:31 AM