Had an issue yesterday where a server rebooted in the middle of the day. There were no memory dumps so I went through the system event log and filtered by event ID 1074 which was for system shut down and found the culprit:
The temp folder no longer exists and is not in the recycle bin either so I cannot hunt in there to see what program updated itself.The process G:\ec2cdc22bd6309305d0603ca21\setup.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason Code: 0x80000000
Shutdown Type: restart
Comment:
I have already set windows update to download and scheduled the installs for Sunday so there are no reboots during a working day.
Does anyone have any idea how I can work out what ran the update?
Cheers
EDIT:
I hadn't thought to cross-reference the time in the application log (very tired today), it looks like Sage was what updated and the .NET framework was what required the reboot.
Social Networking Bookmarks