question

khyatiBhardwaj-2823 avatar image
0 Votes"
khyatiBhardwaj-2823 asked LimitlessTechnology-2700 answered

how can i find why server was restarted

The process C:\Windows\System32\svchost.exe (ENTWEMS14B) has initiated the restart of computer ENTWEMS14B on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned) Reason Code: 0x80020010 Shutdown Type: restart. how do we identify what caused the reboot exactly

windows-server-2016
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick avatar image
0 Votes"
DSPatrick answered DSPatrick commented

Check the \winowsupdate.log Most likely was an update.

--please don't forget to upvote and Accept as answer if the reply is helpful--



· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--



0 Votes 0 ·
Docs-4663 avatar image
0 Votes"
Docs-4663 answered

To view the common causes of restarts and shutdowns:

Open event viewer > filter for these event numbers:

41
1074
6006
6008


.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post there is /\ with a number: click = a helpful post
.
.
.
.
.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LimitlessTechnology-2700 avatar image
0 Votes"
LimitlessTechnology-2700 answered

Hello

Thank you for your question and reaching out.
I can understand you are having some issues \ queries related to Server rebooted.

You can check Windows update history by which you will be able to find if it was caused by Windows updates or Usually it can happened t when a remote shutdown command has been sent to a computer.

Either from SCCM, WSUS, disgruntled co-worker, etc





--If the reply is helpful, please Upvote and Accept as answer--

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.