Windows Server 2016 automatically restart

Question

We've had a 2016 reboot on critical servers after updates! Even worse, during operating hours! We have a group policy to prevent an automatic restart of the servers if a new update(s) is available:

• Configure automatic updating: 3 - Auto download and notify for install

These settings just working fine on the 2012R2 servers, but all server 2016 restarted without administrator consent. The event log contains this entry:

The process C:\WINDOWS\system32\svchost.exe ("ServerName") has initiated the restart of computer "ServerName" on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned) Reason Code: 0x80020010 Shutdown Type: restart

Solution

If you set three policies in GPO like below:

1- No auto-restart with logged on users for scheduled automatic updates installations.
2- Re-prompt for restart with scheduled installations.
3- Configure automatic updating: 3 – Auto download and notify for install.

So,

the no auto-restart with logged on users for scheduled automatic updates installations policy behaviour changed in Windows 10/Windows Server 2016.

Policy no auto-restart with logged on users for scheduled automatic updates installations only applies when Configure Automatic Updates is set to option 4-Auto download and schedule the install.

At the same time, option 4-Auto download and schedule the install only valid if values exist for ScheduledInstallDay and ScheduledInstallTime.

So, although you have configured to not re-start when there are log on users, automatically re-start will still happens at scheduled time.

Below are relate articles, just for you to have an further understanding.

https://docs.microsoft.com/en-us/windows/deployment/update/waas-restart

https://msdn.microsoft.com/en-us/library/dd939844(v=ws.10).aspx

Pejvak you can choose option 2 for Configure automatic updating According to this link to solve the problem too.

Comments

[Harry Johnston]

The most common cause of an unexpected reboot of this sort is that someone installed the updates via the Windows Update control panel and then neglected to reboot the server when the install was complete. Could that be your problem?

[Pejvak Javaheripour]

Hi Harry, this isn't unexpected reboot, installation of updates started on several 2016 servers, and after one hour we notified all servers faced with a clean restart. (The process C:\WINDOWS\system32\svchost.exe ("ServerName") has initiated the restart of computer "ServerName" on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned) Reason Code: 0x80020010 Shutdown Type: restart)

[Harry Johnston]

By "unexpected" I just mean "you personally didn't expect it to happen" which I presumed to be the case since otherwise it wouldn't have been a problem. When you say the installation of updates started, do you mean that the installation started by itself or that someone intentionally started them? Was anybody logged into the servers when the updates started? When the reboot happened? (Please edit your question to describe the exact sequence of events.)

[Harry Johnston]

... also, have you checked the registry keys to make sure the group policy has actually taken effect? The AUOptions value should be set to 3.

[Pejvak Javaheripour]

Hi Tom, Thank you for your answer. All server have a valid license, and all of them activated over the internet.

[Tom]

Hi Pejvak, your welcome, so according to your question update I updated my answer.