Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 53723
  • Last Modified:

Unexpected restart, 0x80020002 by svchost and auto-updates is NOT on

I have an EventID 1074 "The process C:\Windows\system32\svchost.exe (MMUSCHP366) has initiated the restart of computer MMUSCHP366 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Recovery (Planned)
 Reason Code: 0x80020002
 Shutdown Type: restart
 Comment:" <- insert cricket chirping sound wave here
Automatic Windows Update is turned OFF by GPO.
We are running SCCM
However, all of the boxes rebooted by SCCM had the message "The process C:\Windows\SysWOW64\CCM\CcmExec.exe (MMUSCHZ4009) has initiated the restart of computer MMUSCHZ4009 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80020001
 Shutdown Type: restart
 Comment: Microsoft Configuration Manager has restarted your computer after installing a Software Package or a Software Update that requires a reboot.
"
This occurred on a Windows 2008 R2 SQL CLUSTER and both of my cluster servers rebooted at the exact same second (this is NOT a good thing).
The SCCM team swears it was not them.
So if not them who?
0
RaceTrout
Asked:
RaceTrout
  • 4
  • 3
  • 2
  • +1
1 Solution
 
akhalighiCommented:
From planned (Recovery) it looks like servers received updates and restarted. go to control panel and check when latest updates are applied. this tells you if SCCM says the right thing.
0
 
RaceTroutAuthor Commented:
Per Windows Update there were patches installed at 9pm the day before which was six hours before this reboot.
However, these servers were alledgedly on a do not reboot list for SCCM.  
All of the other SCCM rebooted servers rebooted within one hour of their updates being applied.
Is there somewhere that I need the SCCM team to check to confirm that they did not do this?  
Or more importantly that they do not do this again!
0
 
akhalighiCommented:
Could be due to approval rules in SCCM . Did they set a time in approval rules for these servers ? If they set the rule to apply updates until hh:mm , SCCM will reboot the servers right at that time.

 
0
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

 
merowingerCommented:
How is the Group Policy "Configure Automatic Updates" configured?
Check out the exexmgr.log in C:\windows\system32\ccm\logs
0
 
KezziCommented:
Do you have maintenance windows set for a collection where these servers are listed?
If the maintenance window is too short for the updates to install and reboot, it will wait till the next available window to do the reboot.
this will explain it in more detail:
http://myitforum.com/cs2/blogs/socal/archive/2007/12/03/configmgr_2D00_maintenance_2D00_windows_2D00_explained.aspx
0
 
RaceTroutAuthor Commented:
I apologize for the delay in getting back to you all.  

Although I do appreciate the replies about where to look (none of which I understand because I am not an SCOM/SCCM sort of fellow) what I need 1st is:  Is this Reason Code: 0x80020002 being cause by SCCM or could there be other sources?  

The SCCM team has already denied that it was them and before I push the issue with them I need to do my due diligence to eliminate other possibilities.

Thanks!
0
 
KezziCommented:
check the c:\windows\windowsupdate.log to see if it corresponds with an update.  also if any updates were installed you generally get events for them in the system event log.  If updates and been downloaded and installed manually but the reboot postponed, it will sometimes reboot anyway as soon as there is no active logged on session.
4
 
merowingerCommented:
Also check the wuahandler.log from C:\windows\system32 or syswow64\ccm\logs
0
 
RaceTroutAuthor Commented:
I did some digging into the WindowsUpdate.log as suggested above.

What I found was that SCCM installed updates, set requiresReboot=1 and exited as it was expected to as this system was set to no reboot.

The culprit now appears to be Windows Update(AU).  AU ran, found the reboot required and took it upon itself to do so.

Per http://social.technet.microsoft.com/Forums/ar/configmgrsum/thread/b854c5a7-b044-41b3-b4a0-fbf6b24aad6c
If you have the WUA set in the Windows UI to anything other than disabled you see still see notifications from and possibly reboots from WUA outside of SCCM. You need the service running but you need a GPO to disable that setting.
0
 
merowingerCommented:
As i already mentioned check out the Policy "Configure Automatic Updates"
If it is set to disabled there should not happen a reboot from Windows Update Agent
0
 
RaceTroutAuthor Commented:
This solution showed me where to find the culprit and thus my ultimate solution.
0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 4
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now