RuntimeBroker shutting down (no restart) windows 10 virtual machine on esxi. event ID 1074

Question

Hello, could you give me a suggestion to try to solve this random problem that happens on 2 or 3 virtual machines (win 10 build 1909) running on esx host?
These vmachines shutdown randomly (no restart) without a rule. When it happensd I need to start manually virtual machine.
This behavior It is not linked to windows updates or something else. It appens also during working hours, and not on all virtual machines. Some virtual machines (same specs) are not affected.

On event viewer I find event id 1074: The process C:\Windows\System32\RuntimeBroker.exe (COMPUTERNAME) has initiated the power off of a computer (COMPUTERNAME) on behalf of user DOMAIN\REMOTEVMUSER for the following reason: Other (Unplanned)”

No useful

I don't know how to solve...

thank you

marco

ps: on this link they talk about it, without a solution: https://social.technet.microsoft.com/Forums/en-US/da81c9c7-59e6-490b-b38b-120c86494fb5/runtimebroker-shutting-down-machine?forum=win10itprogeneral

Answer 1

Hi Molly, this is not a restart triggered by the auto Windows Update.

This is a regular shutdown. Virtual machine stays off.
I need to to start virtual machine manually later.
No malware detected.

Marco

Answer 2

Hi,

Welcome to Microsoft Q&A.

Is there event ID 1001/6008 in the system event log? Is there a Bluse Screen when this issue happens?

Usually, unexplained reboots are caused by the following.

Unstable hardware devices, expired device drivers, interference from three-party programs, and system abnormalities.

Has any special operation been done during this time? For example, certain drivers were installed, certain patches were updated/certain software was installed. It is recommended that you can undo the previous changes step by step.

It is also necessary to exclude that the reboot was caused by a driver or a patch/application.

Best regards,
Molly

--------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi MollyLu,

thank for your reply, I have just checked: no event 1001 nor 6008, and no bluescreen.

It just shutdown because "RuntimeBroker.exe" has decided that it is time for shutdown, without taking care that it is a working computer.
It happend in random time, no matter if high or low processor work, no matters of hours.
These virtual machines stay on h24, because they run a simply file sync program. And the machine have to stay ON h24.

I googled on the net: this is an unsolved problem. It happens on windows 10 virtual machines

Marco

Answer 4

Hi @mrcmobile ,

Generally, this kind of restart is triggered by the auto Windows Update.

Was your computer workgroup or domain joined?

If that's not Home edition, please use the group policy to schedule the auto-restart:

Manage device restarts after updates

https://learn.microsoft.com/en-us/windows/deployment/update/waas-restart

If your issue persists, after changed restart scheduler, try to update system to the latest version and run full scan with Windows Defender to make sure there is no malware on your system.

Best regards,
Molly

--------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Can anyone in MSFT give a clear answer why RuntimeBroker.exe trigger a shutdown (not reboot) because we see this happen in windows server 2016 as well