Auto Updates Restarting Server

One of our servers mysteriously restarted yesterday for no apparent
reason. When I looked in the event log there was the following
message:

"The process winlogon.exe has initiated the restart of computer
COMPUTERNAME on behalf of user NT AUTHORITY\SYSTEM for the following
reason: No title for this reason could be found"

I looked on forums regarding this message and many posts pointed
towards WSUS. When I looked in my windowsupdate.log of the server the
following messages appeared at exactly the same time of the reboot;

CltUI AU client reboot notification: user clicked Restart Later
AU AU received handle event
AU WARNING: Initiating reboot since no user logged on
AU AU invoking RebootSystem (OnRebootNow)
Misc WARNING: SUS Client is rebooting system.
AU AU invoking RebootSystem (OnRebootRetry)

This would suggest that auto updates rebooted the machine. However our
GPO for auto updates has the setting for "No auto-restart for logged
on users" enabled along with "Configure Automatic Upates" set to 4
(Automatic download and schedule install" which should stop this
happening.

The only thing I can think that may have happened is that someone
logged off the server via an RDP session and because AU thought
(correctly I suppose) there was no one logged on it initiated a
restart. Is this how AU is supposed to behave on servers?

Cheers

C

Try posting here instead: microsoft.public.windows.server.update_services

On the web:
http://www.microsoft.com/communities...pdate_services

In your newsreader:
news://msnews.microsoft.com/microsof...pdate_services
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Broonie wrote:
> One of our servers mysteriously restarted yesterday for no apparent
> reason. When I looked in the event log there was the following
> message:
>
> "The process winlogon.exe has initiated the restart of computer
> COMPUTERNAME on behalf of user NT AUTHORITY\SYSTEM for the following
> reason: No title for this reason could be found"
>
> I looked on forums regarding this message and many posts pointed
> towards WSUS. When I looked in my windowsupdate.log of the server the
> following messages appeared at exactly the same time of the reboot;
>
> CltUI AU client reboot notification: user clicked Restart Later
> AU AU received handle event
> AU WARNING: Initiating reboot since no user logged on
> AU AU invoking RebootSystem (OnRebootNow)
> Misc WARNING: SUS Client is rebooting system.
> AU AU invoking RebootSystem (OnRebootRetry)
>
> This would suggest that auto updates rebooted the machine. However our
> GPO for auto updates has the setting for "No auto-restart for logged
> on users" enabled along with "Configure Automatic Upates" set to 4
> (Automatic download and schedule install" which should stop this
> happening.
>
> The only thing I can think that may have happened is that someone
> logged off the server via an RDP session and because AU thought
> (correctly I suppose) there was no one logged on it initiated a
> restart. Is this how AU is supposed to behave on servers?
>
> Cheers
>
> C