So I guess the next question would be, are you sure it’s that particular deployment that initiated the reboot? If those logs are still around from 7/16, you may want to go through the UpdatesDeployment.log (or maybe the RebootCoordinator) and try and track down the GUID of that SUG deployment that initiated the reboot at 3:59pm. Then add the Deployment Unique ID column to your Deployment tab within the console just to confirm you’re looking at the right deployment.
Do you know if it rebooted without warning or did it throw up the countdown (based on the time you have configured in your client settings)? I had this same problem a month or two ago and even though I had reboot suppressed just like you are doing, in one of the deployments, I chose to have it “Display in Software Center and only show notifications for computer restarts”. I found out from doing that, that even though you have reboots suppressed in the deployment, it still shows the user the reboot countdown. From: [email protected] [mailto:[email protected]] On Behalf Of HELMS, DAVID C Sent: Wednesday, July 29, 2015 10:45 AM To: [email protected] Subject: RE: [mssms] SU reboot behavior question Thanks James. Wasn’t 100% sure about those entries in the WU log. Here is the entry in system, where it shows the client initiating the shutdown. I don’t think it has anything to do with a user being logged on but I wanted to check with others. [cid:[email protected]] From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Beardsley, James Sent: Wednesday, July 29, 2015 10:27 AM To: [email protected]<mailto:[email protected]> Subject: RE: [mssms] SU reboot behavior question ***This is an EXTERNAL email. Please do not click on a link or open any attachments unless you are confident it is from a trusted source. ________________________________ I use these same settings and I have users logged in all the time, so I don’t think that’s it. I could be wrong but I believe that snippet of the WindowsUpdate.log does not necessary indicate that it was WU that initiated the shutdown. That just means the service was stopped when the computer was being shutdown/rebooted. I have those same lines in my log from when I manually rebooted this morning. I would look in the System log and search for the “USER32” source entry around the time that you think the computer was rebooted. It will state clearly in that event what user or source rebooted the computer. It’ll say something like this… just to confirm it was ConfigMgr rebooting and not some other source. [cid:[email protected]] From: [email protected]<mailto:[email protected]> [mailto:[email protected]]<mailto:[mailto:[email protected]]> On Behalf Of HELMS, DAVID C Sent: Wednesday, July 29, 2015 9:16 AM To: [email protected]<mailto:[email protected]> Subject: [mssms] SU reboot behavior question I have some workstations that recently rebooted after updates installed and I’m trying to determine why this happened. I was told there is a service account logged in on these workstations so I wasn’t sure if someone logged on would bypass the suppress reboot. I’ve read other articles with folks having similar issues but haven’t seen any talk about if a user is logged in. 1. User notifications is set to Hide all. 2. We do not use maintenance windows. 3. In the WindowsUpdate.log it shows AU intiates service shutdown. a. [cid:[email protected]] 4. Automatic Updates is set to disabled on the workstation. 5. There aren’t any GPs being applied to the workstations that would modify SU behavior. [cid:[email protected]] ________________________________ Confidentiality Notice: This e-mail is intended only for the addressee named above. It contains information that is privileged, confidential or otherwise protected from use and disclosure. If you are not the intended recipient, you are hereby notified that any review, disclosure, copying, or dissemination of this transmission, or taking of any action in reliance on its contents, or other use is strictly prohibited. If you have received this transmission in error, please reply to the sender listed above immediately and permanently delete this message from your inbox. Thank you for your cooperation. ________________________________ Confidentiality Notice: This e-mail is intended only for the addressee named above. It contains information that is privileged, confidential or otherwise protected from use and disclosure. If you are not the intended recipient, you are hereby notified that any review, disclosure, copying, or dissemination of this transmission, or taking of any action in reliance on its contents, or other use is strictly prohibited. If you have received this transmission in error, please reply to the sender listed above immediately and permanently delete this message from your inbox. Thank you for your cooperation.
