I feel pretty safe calling myself a power user, but on Wednesday night I just sat in front of my Windows 10 desktop and almost punched my new 34′ LCD display as my desktop decided to reboot itself. To say that I was frustrated was an understatement. I was in the middle of working on numerous consulting projects… to add insult to injury the update took almost 4 minutes to apply to my desktop. This on a machine that usually boots to the desktop from a cold start in 15 seconds (benefits of having a high end desktop).
It’s now Friday and I finally have some time to try and figure out what actually happened? Why did my Windows 10 desktop up and reboot itself, seemingly applying some type of update. I had received an odd reboot dialog box earlier in the evening and had declined it. Looking at the system log I can see the reboot request;
Log Name: System Source: User32 Date: 12/21/2016 10:10:34 PM Event ID: 1074 Task Category: None Level: Information Keywords: Classic User: SYSTEM Computer: Bigbird Description: The process C:\WINDOWS\System32\svchost.exe (BIGBIRD) has initiated the restart of computer BIGBIRD on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned) Reason Code: 0x80020010 Shutdown Type: restart Comment:
The last Windows Update was applied on 12/14/16 so it doesn’t appear to have been a Windows Update although code 0x80020010 indicates a restart because of some update.
I kept digging in the system log and found the following entries;
Log Name: System Source: Microsoft-Windows-WindowsUpdateClient Date: 12/21/2016 6:04:57 PM Event ID: 43 Task Category: Windows Update Agent Level: Information Keywords: Started,Installation User: SYSTEM Computer: Bigbird Description: Installation Started: Windows has started installing the following update: Candy Crush Soda Saga
I’m really hoping that Microsoft didn’t reboot my Windows 10 desktop to install some update to Candy Crush Soda Saga but it looks like that’s the case.
Well, lets take care of this once and for all… thankfully I’ve been working on my Powershell kung-fu. I dump the list of all install software via Get-AppxPackage, found the package name for Candy Crush Soda Saga and issued the following in Powershell;
Remove-AppxPackage king.com.CandyCrushSodaSaga_1.80.600.0_x86__kgqvnymyfvs32
Cheers!
Hi Michael, first off, set your ‘Active Hours’ in Windows Update to the most suitable time if you haven’t already. Unfortunately they limit how much time you can actually set in there!
One other tip I saw posted on Ars Technica was that it does the reboot by a Scheduled Task – under Library – Microsoft – Windows – UpdateOrchestrator – Reboot. Apparently just disabling that task is not enough as Windows will just re-enable it next time any updates come down. But if you disable it and then go to C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator, you can take ownership of the ‘Reboot’ task file in there and specifically Deny SYSTEM from accessing that file.
On my machine that seems to have sorted it- Windows tells me it will reboot outside of active hours but I can come in the next morning and it hasn’t rebooted. And thankfully, my files are still open.
Good tip on removing Candy Crush though – that’s now gone!
Hope this helps, Tony
Thanks for the reply Tony.
I guess I was expecting some dialog box to alert me before just rebooting. Thanks for the tips though!
Cheers!
The issue is not with an app but with OS update policy due to which people lose their work. Reboot without permission must not exist at all.
How to dig system log and find which application updating that make the system reboot?
In the eventviewer I only got the code 0x80020010.
Please help me, thank you!
Hi Jacky,
You need to keep digging… it’s in there…
Good Luck!