Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Friday, July 1, 2011 1:37 PM
Twice since I installed Intune, I think that Intune has installed an update which caused an automatic restart/reboot of a PC withOUT advising/asking the user first. This is very disruptive.
I'm not 100% sure it was Intune; please forgive my ignorance, but I'm not sure where to check whether it was a Microsoft update, and whether Intune caused it, that caused the reboot.
I found this in the Event Log:
The process f:\765aa643de678c364fc992d3c82a5b\Setup.exe (MONSTER) has initiated the restart of computer MONSTER on behalf of user Monster\Jay localtemp for the following reason: Other (Planned)
Reason Code: 0x80000000
Shutdown Type: restart
Of course, the f:\765... temporary directory is no longer present, so I can't look in there to see what the installer was.
I looked in C:\WINDOWS\Installer for the most recent file/directory timestamp, and while I did find one at about the right time, it has only several .ICO files in it (which I think are related to an Adobe Reader X installation I had performed an hour or two before, and anyway Adobe Reader X shouldn't cause a silent reboot, so that probably wasn't it).
I looked in C:\WINDOWS\WindowsUpdate.log, but the events nearest to the time of the restart are 13 minutes before:
2011-07-01 12:59:29:720 1116 3344 Report Uploading 1 events using cached cookie, reporting URL = https://msu1a.manage.microsoft.com/ReportingWebService/ReportingWebService.asmx
2011-07-01 12:59:30:554 1116 3344 Report WARNING: Failed to upload events to the server with hr = 80004005.
2011-07-01 12:59:30:554 1116 3344 PT WARNING: ReportEventBatch failure, error = 0x80244019, soap client error = 10, soap error code = 0, HTTP status code = 404
2011-07-01 12:59:30:554 1116 3344 Report WARNING: Reporter failed to upload events with hr = 80244019.
.. and two minutes after:
2011-07-01 13:13:45:248 1116 1aa0 Shutdwn user declined update at shutdown
2011-07-01 13:13:45:287 1116 1aa0 AU Successfully wrote event for AU health state:0
2011-07-01 13:13:45:287 1116 1aa0 AU AU initiates service shutdown
2011-07-01 13:13:45:314 1116 1aa0 AU ########### AU: Uninitializing Automatic Updates ###########
2011-07-01 13:13:45:778 1116 1aa0 Agent Sending shutdown notification to client
2011-07-01 13:13:45:785 5428 26dc COMAPI WARNING: Received service shutdown/self-update notification.
2011-07-01 13:13:46:161 1116 1aa0 Report CWERReporter finishing event handling. (00000000)
2011-07-01 13:13:47:058 1116 1aa0 Service *********
2011-07-01 13:13:47:058 1116 1aa0 Service ** END ** Service: Service exit [Exit code = 0x240001]
2011-07-01 13:13:47:085 1116 1aa0 Service *************
.. and neither would seem to relate to an update being installed.
I'm not sure whether any of the directories under C:\WINDOWS\System32\LogFiles\ would be relevant?
That the user referenced in the Event Log entry (Monster\Jay localtemp) is the local administrator equivalent which I use when I’m installing something / responding to a UAC Elevation prompt, suggests that it may indeed have been an installation I started myself, and not a update/ an Intune action.
So, anyway:
Q1: Where/how would I check what caused a restart?
Q2: How do I configure Intune in the same way that I can configure updates through Windows Update and WSUS, to automatically install, but to give the user a configurable amount of time (hours, days) to voluntarily restart when needed, before finally forcing an automatic restart?
Thank you,
Jay
All replies (6)
Tuesday, December 23, 2014 5:30 AM ✅Answered
In fact, later discussions on the same topic seem to indicate that it is not possible to set Intune to automatically apply reboot-will-be-required updates in a way which will NOT reboot the computer out from underneath a logged-in-but-idle user.
See the newer thread Intune
automatic reboots - how to ALWAYS give the user control (except after
Deadline)?
Saturday, July 2, 2011 7:12 AM
Okay, since Intune has prompted me to reboot for updates - twice! - since I made this post, clearly it wasn't Intune which caused the un-announced reboot.
I'd still like to know where in Intune it is possible to configure the sorts of Group Policy items which I usually set under Computer Configuration -> Administrative Templates -> Windows Components: Windows Update, specifically "No auto-restart with logged on users for scheduled automatic updates", "Re-prompt for restart with scheduled installations", and related.
On the subject of re-prompting: the Intune re-prompt is MUCH too frequent, and it always steals focus. (Search for Outlook Reminders for intense argument about why stealing focus on frequent re-prompting is a Bad Thing(TM) - I'll give you a hint, you end up typing in the wrong dialog box, with sometimes disastrous results). So, for the Intune client itself, please give us a way to:
- Set the re-prompt interval, and
- Prevent the dialog box from stealing focus (even if it does pop to the top of the visible window stack - the input focus should remain in whatever other window it was in before, to avoid the user's keystrokes accidentally going to the "yes, reboot me now! I want to lose all of my unsaved work!" button in the Intune "reboot now?" prompt)
Thanks!
Jay
Wednesday, July 6, 2011 3:42 PM
Hi Jay,
Thanks for the feedback. Appreciate it very much. To prevent reboot with logged on nusers you can create a policy template to create have a setting similar to the one you mention above.
thanks,
Mandar
Wednesday, July 6, 2011 5:15 PM
The policy name is "Windows Intune Agent Settings" and the setting is "Delay between prompts to restart Windows after installation of updates (minutes)"
Thanks,
Scott
Wednesday, July 6, 2011 9:33 PM
The policy name is "Windows Intune Agent Settings" and the setting is "Delay between prompts to restart Windows after installation of updates (minutes)"
Thanks,
Scott
Thank you. At the moment, that policy setting is limited to a maximum delay between re-prompts of 30 minutes. This should be settable MUCH higher by the Intune administrator.
And then there's still the issue of the abusive stealing of input focus.
Wednesday, October 7, 2015 1:42 AM
I'm running into the exact same issue, following the link I've concluded: apply settings to delay a restart to [4] hours and to prompt to [10] minutes. I haven't tested this yet but it appears it will only restart after 4 hours or past deadline and a repeating prompt every 10 minutes. Do you suspect this the case?
The accompanying text really needs to be clarified.
Also, would it be a balloon bubbling in the Taskbar or a window/prompt asking for a restart?
[EDIT] After checking, the maximum delay is 30 minutes not 4 hours and also found that a long deadline should allow for repeated prompts. https://social.technet.microsoft.com/Forums/en-US/77d86dcc-1e89-4191-b023-03316978d46e/windows-intune-reboot-client-machines?forum=microsoftintuneprod&prof=required
I will test and report back.
[EDIT] I received a passive notification - where the icon changes and adds a warning symbol - clicking on it prompts me to install. I suspect the prompt is due to the install schedule of 9:00AM.
Is my assumption correct that WHEN 9:00AM rolls around, Intune should install the pending updates and then ACTIVELY prompt the user?
IF a passive "prompt" (icon change) is a notification for a restart then that's unacceptable behavior.
For clarification purposes: I'm referring to and my desire is the first picture/prompt - allowing the user to control restart behavior before deadline - an active notification - LINK: http://blogs.technet.com/b/windowsintune/archive/2013/01/09/policy-settings-for-mandatory-updates.aspx and not this: from the link "On Windows 8 clients the Windows Intune Center icon will change to reflect the need to restart, but there is no active notification like the balloon. Clicking the icon will bring up the notification window."
I'll respond back to this thread after 9:00AM tomorrow unless someone can shed light on this.
[EDIT] I have adjusted my policy for testing purposes. I have yet receive any sort of active prompt. It's passive - there is not intermitted prompt or even initial active prompt. Please also see for a similar topic: https://social.technet.microsoft.com/Forums/en-US/77d86dcc-1e89-4191-b023-03316978d46e/windows-intune-reboot-client-machines?forum=microsoftintuneprod&prof=required
and suggested a feature at http://microsoftintune.uservoice.com/forums/291681-ideas/suggestions/10109415-active-notification-prompt-to-restart-to-update