Hyper-V unexpectedly auto-reboot by auto-installed update

Question

Hi,

today I've got alarms from 2 Hyper-V hosts they are shutting down. Thought at first on power issues, but both have double UPS, redundant PSUs, so it was not likely power related. Once they came up again, I examined Event logs and found this:

First Event ID 43:

Installation Started: Windows has started installing the following update: 2023-06 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5027219)

And Event ID 19:

Installation Successful: Windows successfully installed the following update: Windows Malicious Software Removal Tool x64 - v5.114 (KB890830)

Then 5 hours later, event id 1074:

The process C:\Windows\system32\svchost.exe (HYPERV2) has initiated the restart of computer HYPERV2 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned)

Reason Code: 0x80020010

Shutdown Type: restart

Those Hyper-V hosts run for 4 or 5 years and have never ever auto-reboot nor auto-install anything! Untill now. They are both Server 2016 Standard. How is it possible now all of the sudden both auto-reboot on the same day? Ok, might be coincidence the same day, but auto-reboot - this should not happen on Hyper-V!

They are both stand-alone, not domain joined, no GPO applied, auto-install and auto-reboot are DISABLED.

What the heck happened? Thoughts?

Answer 1

As I mentioned unfortunately you don't have complete control over windows updates via the internet. One option may be to set the Windows Update (wuauserv) service to Disabled

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hello there,

How often is the backup company taking snapshots of your virtual machines?

One thing you may want to check is to see if the server is being put in a saved state for backup. This could happen if the guest OS does not have appropriate VSS provider in the guest OS which could cause the hyper-visor to put VM in saved state during backup.

What Guest OS stack is the SFTP Server sitting on?

I'd like to check if all the VMs get restarted or specific VMs get restarted? When the VMs get started, did the Hyper V host restarted unexpectedly?

To troubleshoot the issue, I'd suggest you monitor on one reboot VM, enable dump for unexpected shutdown, then analyze the dump, check if there's any system hang or crash on the VM system.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 3

You could stand up your own WSUS server to where you'll have complete control of which servers update and when that happens. My experience is that critical updates do not always honor update settings from internet.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Hi,

thank you both for your inputs.

@Limitless Technology , in my case VMs are not a problem right now. Problem is Hyper-V host, which was in both cases standalone, always patched and rebooted manually for several years, now all of the sudden it changed behavior and all by itself auto-installed updates and by itself rebooted. If I look at settings, it is set to manually install and to not allow auto reboot. This is the problem! Why it did not obey settings.

@Anonymous , those are standalone Hyper-V servers in small companies, where company only has 1 Hyper-V server. Thogh I could over-complicate by setting up WSUS on VM and loop it back to Hyper-V host to update from, I am not paid to do such designs. They call me only when something fails. And in this case I have no explanation, why host installed and rebooted by itself, despite of being setup not to.