WU Restarting Server?

One of our servers mysteriously restarted yesterday for no apparent
reason. When I looked in the event log there was the following
message:

"The process winlogon.exe has initiated the restart of computer
COMPUTERNAME on behalf of user NT AUTHORITY\SYSTEM for the following
reason: No title for this reason could be found"

I looked on forums regarding this message and many posts pointed
towards WSUS. When I looked in my windowsupdate.log of the server the
following messages appeared at exactly the same time of the reboot;

CltUI AU client reboot notification: user clicked Restart Later
AU AU received handle event
AU WARNING: Initiating reboot since no user logged on
AU AU invoking RebootSystem (OnRebootNow)
Misc WARNING: SUS Client is rebooting system.
AU AU invoking RebootSystem (OnRebootRetry)

This would suggest that auto updates rebooted the machine. However our
GPO for auto updates has the setting for "No auto-restart for logged
on users" enabled along with "Configure Automatic Upates" set to 4
(Automatic download and schedule install" which should stop this
happening.

The only thing I can think that may have happened is that someone
logged off the server via an RDP session and because AU thought
(correctly I suppose) there was no one logged on it initiated a
restart. Is this how AU is supposed to behave on servers?

Cheers

C

broonie27 wrote:

> The only thing I can think that may have happened is that someone
> logged off the server via an RDP session and because AU thought
> (correctly I suppose) there was no one logged on it initiated a
> restart. Is this how AU is supposed to behave on servers?

Yes.

The best way to avoid these unplanned restarts is to configure your servers for
Automatic Updates option 3, which downloads updates automatically but only
installs them when instructed to do so by an administrator.

Harry.