Server rebooted unknowingly

Question

Hi folks,

One of my Windows Server 2019 got automatically rebooted with below pasted message in Event ID 1074. On same date a KB was installed on my server, so it seems that this reboot is triggered by that update installation.

However, we have configured GPOs to stop servers from being rebooted automatically (pasting a snip below).

Could you please help me understand, how this reboot could have been triggered, and where can I get relevant information on this.

Event details:

The process C:\Windows\servicing\TrustedInstaller.exe has initiated the restart of computer on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Upgrade (Planned)
Reason Code: 0x80020003
Shutdown Type: restart
Comment:

GPO applied:

Any help would be appreciated, thanks in advance!

Answer 1

Some updates deemed critical may not always honor those settings.

--please don't forget to close up the thread here by marking answer if the reply is helpful--

Answer 2

Hello Apurva Pathak,

You are right, the code "0x80020003" refers to a reboot triggered by an installation, most likely a KB update. Bear in mind that the GPO setting you mentioned applies only when a User Account is logged in the system. System or Service accounts will not apply and updates will carry on.

You can verify this by checking the update history of the server or running Get-HotFix cmdlet to view the installed updates and which one could have caused the reboot.

Additionally, I would recommend:

• Check Event Logs (Application and System) related to time of the reboot, as this can provide you more information about conditions met in the system.
• Check if the GPO is applied correctly in the system. You can use GPRESULT /H to generate a HTML output of the policies and their status.
• Verify if the update was pushed though a Deployment tool, such as SCCM, in which the administrator can request a forceful reboot.

--If the reply is helpful, please Upvote and Accept as answer--