Boot looping - Windows 10

Question

question

ZacAvramides-9858 asked May 12, '22 Crystal-MSFT edited May 30, '22

Boot looping - Windows 10

We are in the process of rolling out a new SOE and using Autopilot and Intune to do it.

For no apparent reason, machines will get caught in a boot loop. The only entry that shows is logged as a User32 event in System logs saying that the NT AUTHORITY\SYSTEM initiated a shutdown with the shtudown.exe process. Reason Code: 0x800000ff

For a while, we thought it was the SCCM client install that was triggering the reboot as disabling that process stopped the reboots on the machines that were rebooting, as they also started the ccmrestart process. We have since disabled and removed that install.

We thought it may have been something with the Intune client however from the IntuneManagementExtension log, for the period that the machine was rebooting, the service never got a chance to start. The service stopped before the machine rebooted, and then the next entry was a few hours later after the reboots stopped.

All machines are pulling the same settings from the same GPOs and programs, yet appears to be no direct link or cause to why one machine will boot loop and another not.

Any help with a direction and logs to dig into would be great.

windows-10-general windows-10-setup

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-05-17T07:46:24.24Z

LimitlessTechnology-2700 answered May 17, '22 ZacAvramides-9858 commented May 17, '22

Hello

Thank you for your question and reaching out.
I can understand you are having some issues related to Boot looping on Windows 10 computer.

The two most common reasons for automatic system shutdown/reboot are Windows Updates and Windows Activation. If both of these are not the actual root cause of the issue, I would probably start checking for scheduled tasks and 3rd party software that may trigger those kinds of actions, as already mentioned above.

Please try to boot into Safe Mode and Disable any Non-Microsoft services.
Could it be malware of some sort and so to eliminate that as a reason it will be worth running a scan of one of the affected PCs. As a further check could you reinstall Windows on another PC.
It would be interesting to see if Process Monitor could be used to find the process calling shutdown.exe
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

--If the reply is helpful, please Upvote and Accept as answer--

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ZacAvramides-9858 · May 17 at 08:30 AM

The Get-WindowsUpdateLog command has so far given us nothing. Where are the logs for Windows Activation?

0 ·

question