I use these same settings and I have users logged in all the time, so I don’t think that’s it.
I could be wrong but I believe that snippet of the WindowsUpdate.log does not necessary indicate that it was WU that initiated the shutdown. That just means the service was stopped when the computer was being shutdown/rebooted. I have those same lines in my log from when I manually rebooted this morning. I would look in the System log and search for the “USER32” source entry around the time that you think the computer was rebooted. It will state clearly in that event what user or source rebooted the computer. It’ll say something like this… just to confirm it was ConfigMgr rebooting and not some other source. [cid:[email protected]] From: [email protected] [mailto:[email protected]] On Behalf Of HELMS, DAVID C Sent: Wednesday, July 29, 2015 9:16 AM To: [email protected] Subject: [mssms] SU reboot behavior question I have some workstations that recently rebooted after updates installed and I’m trying to determine why this happened. I was told there is a service account logged in on these workstations so I wasn’t sure if someone logged on would bypass the suppress reboot. I’ve read other articles with folks having similar issues but haven’t seen any talk about if a user is logged in. 1. User notifications is set to Hide all. 2. We do not use maintenance windows. 3. In the WindowsUpdate.log it shows AU intiates service shutdown. a. [cid:[email protected]] 4. Automatic Updates is set to disabled on the workstation. 5. There aren’t any GPs being applied to the workstations that would modify SU behavior. [cid:[email protected]] ________________________________ Confidentiality Notice: This e-mail is intended only for the addressee named above. It contains information that is privileged, confidential or otherwise protected from use and disclosure. If you are not the intended recipient, you are hereby notified that any review, disclosure, copying, or dissemination of this transmission, or taking of any action in reliance on its contents, or other use is strictly prohibited. If you have received this transmission in error, please reply to the sender listed above immediately and permanently delete this message from your inbox. Thank you for your cooperation.
