Windows 10/11 Forcing reboot when disconnected from PC

sebby v 16 Reputation points
2022-06-21T19:09:21.757+00:00

Hello,

I am finding that when Windows 10/11 installs updates, and I lock my computer or disconnect from my RDP session by locking the screen or clicking the X in top right hand corner of RDP, my pc is rebooting outside of active hours.

This does not matter if my system is on WSUS or not.

I have applied the update both on WSUS and off WSUS and locked the screen and also disconnected to find that my PC automatically reboots.

When Joined to WSUS, here are my regkeys.
The NoAutoRebootWithLoggedOnUser is not working.

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"AUOptions"=dword:00000004
"DetectionFrequency"=dword:00000004
"DetectionFrequencyEnabled"=dword:00000001
"NoAutoRebootWithLoggedOnUsers"=dword:00000001
"NoAutoUpdate"=dword:00000000
"RebootRelaunchTimeout"=dword:000000f0
"RebootRelaunchTimeoutEnabled"=dword:00000001
"RescheduleWaitTime"=dword:00000014
"RescheduleWaitTimeEnabled"=dword:00000001
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:0000000b
"UseWuserver"=dword:00000001
"AutoInstallMinorUpdates"=dword:00000001

My active hours are 8AM-5PM, but I have programs that run over night so when the computer reboots I lose data.

Here is the event

TimeCreated Id LevelDisplayName Message

-----------
-- ---------------- -------
6/17/2022 5:30:01 PM 1074 Information The process C:\Windows\uus\AMD64\MoUsoCoreWorker.exe (COMPUTER1) has
initiated the restart of computer COMPUTER1 on behalf of user NT
AUTHORITY\SYSTEM for the following reason: Operating System: Service pack
(Planned)
Reason Code: 0x80020010
Shutdown Type: restart
Comment:

Please advise!

Thanks

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,713 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
3,003 questions
Windows 11
Windows 11
A Microsoft operating system designed for productivity, creativity, and ease of use.
10,761 questions
{count} vote

3 answers

Sort by: Most helpful
  1. sebby v 16 Reputation points
    2022-06-24T12:19:55.437+00:00

    Last night I uninstalled a cumulative update (KB5014697) on my windows 11 machines.

    I rebooted after uninstalling.

    I went in and Re-downloaded the update.

    Here is the event log:

    PS C:\Users\user1> Get-EventLog -LogName System -InstanceId 44

    Index Time EntryType Source InstanceID Message


    33735 Jun 23 16:09 Information Microsoft-Windows... 44 Windows Update started downloading an update.
    33734 Jun 23 16:09 Information Microsoft-Windows... 44 Windows Update started downloading an update.
    33733 Jun 23 16:09 Information Microsoft-Windows... 44 Windows Update started downloading an update.
    33732 Jun 23 16:09 Information Microsoft-Windows... 44 Windows Update started downloading an update.

    I then disconnected from my windows 11 system by clicking the "X" in the RDP session.

    Here is the event log:

    ProviderName: Microsoft-Windows-Security-Auditing

    TimeCreated Id LevelDisplayName Message



    6/23/2022 3:46:23 PM 4779 Information A session was disconnected from a Window Station.

                                           Subject:                                                                      
                                            Account Name: user1                                                       
                                            Account Domain: DOMAIN                                                      
                                            Logon ID: 0x10FF5A                                                          
    
                                           Session:                                                                      
                                            Session Name: RDP-Tcp#0                                                     
    
                                           Additional Information:                                                       
                                            Client Name: COMPUTER1                                                   
                                            Client Address: x.x.x.x                                                 
    
    
                                           This event is generated when a user disconnects from an existing Terminal     
                                           Services session, or when a user switches away from an existing desktop       
                                           using Fast User Switching.     
    

    As you can see my computer decided to reboot outside of active hours.

    Log Name: System
    Source: User32
    Date: 6/23/2022 5:30:01 PM
    Event ID: 1074
    Task Category: None
    Level: Information
    Keywords: Classic
    User: SYSTEM
    Computer: COMPUTER1.domain.com
    Description:
    The process C:\Windows\uus\AMD64\MoUsoCoreWorker.exe (COMPUTER1) has initiated the restart of computer COMPUTER1 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned)
    Reason Code: 0x80020010
    Shutdown Type: restart
    Comment:

    Why is Windows 11 ignoring the NOREBOOTWITHLOGGEDONUSER regkey?

    214750-sv.jpg

    1 person found this answer helpful.
    0 comments No comments

  2. sebby v 16 Reputation points
    2022-06-28T11:56:57.33+00:00

    I also went and a WSUS Group Policy and applied it to my workstation.
    The system still is rebooting off hours when the norebootwithloggedonuser keys is enabled.

    1 person found this answer helpful.
    0 comments No comments

  3. Limitless Technology 39,811 Reputation points
    2022-06-23T14:40:22.17+00:00

    Hi there,

    You can Turn off Automatically adjust active hours for this device based on activity and see if that is helpful.

    After the reboot can you see any event logs that you can share for quicker troubleshooting.

    You can also use tools like Process Monitor.

    Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry, and process/thread activity. You can get the tool from here

    https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

    You can use Group Policy settings, mobile device management (MDM), or Registry (not recommended) to configure when devices will restart after a Windows 10 update is installed.

    Manage device restarts after updates

    https://learn.microsoft.com/en-us/windows/deployment/update/waas-restart

    Hope this resolves your Query !!

    ----------------------------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept it as an answer–

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.