Why did my Windows 10 restart?

Question

I did run my overnight computations and when I came to my computer, it is restarted :-( I would like to find reason why, if it was due to my computation process crashing or some system update. I have tried to look into the Event Log Viewer, Windows Logs -> System, but I cannot find the cause:

The computer must have restarted around 6:50. The last message before is at 6:03 from WindowsUpdateClient: "Installation Successful: Windows successfully installed the following update: Microsoft Advertising SDK for XAML". Then there are these messages (all at 6:51:13):

• Kernel-General: "The operating system started at system time ‎2016‎-‎07‎-‎02T04:51:13.490451600Z."
• Kernel-Boot: "The last shutdown's success status was false. The last boot's success status was true."
• Kernel-Boot: "The boot type was 0x0."
• Kernel-Boot: "The boot menu policy was 0x1."
• Kernel-Boot: "There are 0x1 boot options on this system."
• Kernel-Boot: "The bootmgr spent 0 ms waiting for user input."

How do I find out the cause of the restart? There is a possibility that it was due to update, but there was cca 50 minutes between the update and the restart. I would like to be really sure about the cause of the restart.

Solution 1

If windows update restarts your machine, you should see an event from user32 stating the reason for shutdown:

It's followed by a bunch of logoff messages, and finally Kernel-General saying something like: "The operating system is shutting down at system time ‎2018‎-‎09‎-‎13T00:40:12.484519400Z.", followed shortly by a corresponding startup message.

If you don't see those types of logoff messages, you probably had a crash, and may find related error events somewhere in the event viewer.

If I'm not sure when a restart happened, I look at the EventLog events at 12pm every day that show the system uptime:

All of these logs are found under Event Viewer/Windows Logs/System.

Solution 2

There are several signs your PC has crashed, including the message on how "The last shutdown's success status was false." Because Windows doesn't have additional information in the crash, it probably wasn't a BSOD.

Unfortunately, further diagnosis is pretty much impossible because you haven't witnessed it. However, it's most likely related to how your "overnight computations" excessively stressed the PC. There may be shortcomings in the cooling/ventilation setup. Other than that it could be pretty much any hardware component being subtly broken.

To illustrate how a successful reboot (preceded by a regular boot) looks like, take a look at this event log. Note how there are messages of some services (including the event logging service) being stopped.

Solution 3

I made a VBScript file and have a shortcut in the startup folder. This displays the most recent boot time. If I want to know why the machine rebooted I view all system events unfiltered, scrolling back from the last time shown by the script and usually can see what happened.

const ToRead = 1
const ToWrite = 2
const ToAppend = 8
const WindowsFolder = 0
const SystemFolder = 1
const TemporaryFolder = 2
for each item in getobject("winmgmts:{impersonationLevel=impersonate}!\\." & "\root\cimv2").ExecQuery("SELECT * FROM Win32_ComputerSystem") : time_zone_offset = item.CurrentTimeZone / 60 : next
set fso = createobject("Scripting.FileSystemObject")
temp_file = fso.getspecialfolder(TemporaryFolder)
if right(temp_file,1) <> "\" then temp_file = temp_file & "\"
temp_file = temp_file & "boot_times.$"
set ws = createobject("WScript.Shell")
ws.run "cmd /C wevtutil.exe qe System /q:""*[System [(EventID=6009)]]"" /rd >""" & temp_file & """", 0,true
build = "booted at"
with fso.opentextfile(temp_file,ToRead)
  while not .atendofstream
    a = .readline
    p = instr(a,"<TimeCreated SystemTime")
    if p > 0 then
      a = mid(a,p+25)
      p = instr(a,"'/>")
      if p > 0 then
        a = replace(left(a,p-1),"T"," ")
        p = instr(a,".")
        if p > 0 then
          a = left(a,p-1)
          if isdate(a) then
            dt = dateadd("h",time_zone_offset,cdate(a))
            build = build & vbcrlf & year(dt) & "-" & twodg(month(dt)) & "-" & twodg(day(dt)) & " " & twodg(hour(dt)) & ":" & twodg(minute(dt)) & ":" & twodg(second(dt))
            end if
          end if
        end if
      end if
    wend
  .close
  end with
fso.deletefile temp_file
msgbox build

function twodg(j)
  twodg = right("0" & j,2)
end function

Comments

[Ramhound]

When did Windows 10 last update itself? When is Windows 10 set to install updates. Update your question to include this information.

[Daniel B]

It doesn't look like the system shut down properly. I'm currently away from my PC though. Please try to filter the log by time and export the filtered log.

[Ramhound]

Its not unusual for some updates to take awhile to install. WindowsUpdateClient was the last event entry before the Kernel event entry, so determine how many updates were installed, and which updates they were. You should also look further back in the previous weeks to see if you can see if this behavior has been before. Update your question to include that information.

[Tomas]

I guess the time is 4:51:13 GMT which is 6:51:13 of my local timezone (CEST). If you look in the screenshot I posted, the time is 6:51:13 there.

[Kodikuu]

That makes sense, the answer itself still stands though.

[Tomas]

Thanks (wasn't me to downvote), even though the answer doesn't give a sure answer :-)

[Ramhound]

@Kodikuu - I issue the downvote precisely because it does not give a sure answer. It also contains a comment, that has nothing to do with answering the question, which ended up being wrong anyways. Perhaps its because I deal with Zulu time daily but immediately understood the mistake the author made and what you meant by the system restarting at 06:51 instead of 04:51 Zulu.

[Kodikuu]

@Ramhound - I can't give a sure answer without commenting for more information, and I can't comment original posts until 50 rep. No win for a new user that wants to help.

[Ramhound]

If you can't give a sure answer without commenting, then don't answer this question, answer a question you can answer without a comment. You won't receive any sympathy from me for submitting an incomplete answer, which contains a irrelevant comment, because you can't submit comment because of your reputation. I have no problem giving love in the form of an up vote to complete and detailed answers though. I should point out I use a userscript, to remove the amount of reputation a user has from the page

[Ramhound]

Of course I also maintain that my votes are always about the quality of the content not who submitted the content. I would have made the same comment if Journeyman Geek submitted it.

[ryanttb]

Thank you. Sample of a crash (happened today while monitor was off): Event Viewer => Windows Logs shows "Error, Application Error, Faulting application name: CtHdaSvc.exe" followed by a few "Information, Windows Error Reporting" entries.