[Help needed:] svchost.exe has initiated the restart of computer

Discussion in 'Windows 10' started by moderate, Oct 14, 2017.

Tags:
  1. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,378
    2,479
    120
    #1 moderate, Oct 14, 2017
    Last edited: Oct 14, 2017
    Hello,

    with the installation of RS3 RTM Enterprise x64 this has started:

    The process C:\WINDOWS\system32\svchost.exe (PC1) has initiated the restart of computer PC1 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned)
    Reason Code: 0x80020010

    ...even if I have set in Policy Editor:
    Computer Configuration > Administrative Templates > Windows Components > Windows Update > No auto-restart with logged on users for scheduled automatic updates installations (Enabled)

    No new update was installed.

    Can anybody help investigating?

    1. How to find, which svchost.exe service does it?
    2. How to deny such unwanted behavior?
     
  2. frepsz

    frepsz MDL Junior Member

    Aug 26, 2014
    73
    18
    0
    #2 frepsz, Oct 14, 2017
    There are numerous reports about Windows (even Enterprise) totally ignoring group policy settings, if it wants to. Probably this is just another example.

    How to find it? If it's a running process, and the PID is logged, you can look it up in Task Manager, right click, go to services, and there you have it. It'll probably be the WU service. What else could it be?

    How to deny? By installing Linux or Windows 7. Remember, you're treated like a product, not a user. Try to report it...
     
  3. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,378
    2,479
    120
    #3 moderate, Oct 14, 2017 (OP)
    That hardly helps. :/

    Of course, it is service. It is svchost.exe. And PID leads to svchost.exe.
     
  4. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,197
    84,763
    340
    #4 abbodi1406, Oct 14, 2017
    Did you enabled the schedule install policy (AUOptions = 4)?

    Event Viewer will probably give more details
     
  5. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,378
    2,479
    120
    #5 moderate, Oct 14, 2017 (OP)
    [reserved]
     
  6. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,378
    2,479
    120
    #6 moderate, Oct 14, 2017 (OP)
    Autoupdate key was empty (there were only subkeys (subfolders)).

    But after your remark, I imported this now:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
    "AUOptions"=dword:00000001
    "CachedAUOptions"=dword:00000001
    "ElevateNonAdmins"=dword:00000001
    "ForcedReboot"=dword:00000002
    "IncludeRecommendedUpdates"=dword:00000001

    Thanks. Interesting is, that it even doesn't install any update. I already browsed through Event Viewer, that message is the only thing, I found.

    BTW: Thanks for x32 CAB.
     
  7. Blind_Faith

    Blind_Faith MDL Novice

    Jul 30, 2010
    35
    2
    0
    #7 Blind_Faith, Oct 15, 2017
    Could it be from a minor hardware or driver failure?

    I use to have to set a switch to stop that behavior.

    Event would always be of little help...
     
  8. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,378
    2,479
    120
    #8 moderate, Oct 15, 2017 (OP)
    No, as abbodi1406 reminded, it was the issue, that I didn't set AUOptions = 1. Probably.