6

I had some processes running on my Windows (taking a long time) and many open applications (Eclipse, sqlDeveloper etc).

It's important to know that while the PC was running - It was disconnected from the web (physically removed the Ethernet cable)

Yesterday my system restarted causing the processes to stop and applications began closing/crashing. I lost a bunch of data...
My question is how to find out what caused Windows to restart?
I suspect it's related to a Windows update?

UPDATE
Adding the events from Event viewer:

    The kernel power manager has initiated a shutdown transition.Action: Power Action Reboot 
    The system has prepared for a system initiated reboot from Sleeping (Idle).
    Virtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.
    The last shutdown's success status was true. The last boot's success status was true.
    EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ‎2023‎-‎12‎-‎14T00:33:07.000000000Z.
    The boot menu policy was 0x1.
    The boot type was 0x0.
    There are 0x1 boot options on this system.
    The bootmgr spent 0 ms waiting for user input.
    The firmware reported boot metrics.
    ACPI thermal zone \_TZ.TZ00 has been enumerated.     
    ACPI thermal zone \_TZ.TZ01 has been enumerated.         
    The system has detected a system initiated reboot from Sleeping (Idle).
    Connectivity state in standby: Disconnected, Reason: NIC compliance
    The system session has transitioned from 0 to 1.Reason SessionUnlock 
    The system session has transitioned from 1 to 3.Reason InputAccelerometer 
    The system session has transitioned from 3 to 4.Reason InputAccelerometer 
    The system session has transitioned from 4 to 6.Reason InputHid
music2myear
  • 41,771
JavaSheriff
  • 224
  • 2
    “Is this a new feature Microsoft introduced?” - No; Your system likely crashed. For the last 2 decades Windows has been able to either (perform a memory dump and automatically reboot) or automatically reboot. Your system likely is configured to just automatically reboot upon a kernel crash. – Ramhound Dec 14 '23 at 14:41
  • https://www.reddit.com/r/Windows10/comments/sqq79x/the_kernel_power_manager_has_initiated_a_shutdown/ – JavaSheriff Dec 14 '23 at 15:16
  • 1
    My machine in over 7 years not once rebooted due to that even, which means, its hardware dependent. It’s still NOT a new feature. – Ramhound Dec 14 '23 at 15:21
  • 2
    If you have your system connected to a UPS you might want to change the battery. – Ramhound Dec 14 '23 at 15:25
  • My machine in also about 5 years old and never rebooted due to that event.... so might be a new thing MS added – JavaSheriff Dec 14 '23 at 15:59
  • 3
    In Windows 10 and up, Microsoft created scheduled tasks that will automatically become armed after a windows update is downloaded. It will automatically install the update, next time it will see if a reboot is necessary, and it will automatically reboot. To what I learned, it should take a week before it will reboot your computer, but if you installed updates a week ago but not rebooted, and now unplugged the network cable thinking it was enough, that will still get your pc rebooted. – LPChip Dec 14 '23 at 16:30
  • 1
    I just failed an audit on it. I strongly believe that this is asking for opinions.its not asking for how to find the fault, it is asking what the problem is. – Rohit Gupta Dec 21 '23 at 10:43
  • @RohitGupta this question is poorly presented for several reasons, but also contains a specific question (once you peel away the frustration-driven parts) and the multiple questions. I agree that it would be better if it were significantly edited. – music2myear Dec 21 '23 at 15:31

2 Answers2

13

To find out the reason for a reboot, use one of the following commands:

  • PowerShell :

    Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 41, 1074, 6006, 6605, 6008; } | Format-List Id, LevelDisplayName, TimeCreated, Message

  • CMD :

    wevtutil qe System /q:"*[System[(EventID=41) or (EventID=1074) or (EventID=6006) or (EventID=6005) or (EventID=6008)]]" /c:100 /f:text /rd:true

If the computer has crashed, and not just rebooted, check folder %SystemRoot%\Minidump for a .dmp file whose creation-time corresponds to the time of the crash.

If found, analyze this file using BlueScreenView, or zip it up and publish it online for us to have a look (OneDrive, Dropbox etc).

If minidumps are not enabled, I suggest to enable Small memory dumps. See the article Configure Windows 10 to Create Minidump on BSOD.

Useful reference : How to find out why your PC shut down for no reason on Windows 10 and 11.

harrymc
  • 480,290
  • 1
    The process C:\Windows\System32\RuntimeBroker.exe (DEV-PC) has initiated the restart of computer DEV-PC on behalf of user DEV-PC\dev for the following reason: Other (Unplanned) – JavaSheriff Dec 14 '23 at 15:14
  • 3
    This was then Windows Update that restarted. You may prevent it by running gpedit.msc and in Computer Configuration > Administrative Templates > Windows Components > Windows Update > Legacy Policies and set "No auto-restart with logged on users for scheduled automatic updates installations". – harrymc Dec 14 '23 at 15:23
  • 3
    RuntimeBroker is Windows Update, probably for Office. Without the above group policy, Windows might only wait with already-downloaded updates until what it thinks are non-working hours or the hour that is specified. – harrymc Dec 14 '23 at 15:34
  • 9
    Wow I hate MS So much!!! I lost so much data, and my 50hr backup process was terminated, unbelievable!!! thank you so much for this info! harrymc! – JavaSheriff Dec 14 '23 at 20:33
  • 10
    @JavaSheriff Note that preventing Windows Update from automatically restarting is notoriously difficult. The only reliable way I've found is using Reboot Blocker, which runs in the background and continuously adjusts your active hours. – isanae Dec 15 '23 at 04:20
  • @isanae If you have Windows 10/11 Pro it's easy (although still not very friendly). You just have to enable the appropriate group policy. And actually it seems even on Windows 10/11 Home you can manually install the group policy editor and enable the rule. See also here. – Clonkex Mar 13 '24 at 00:40
5

Look in the Event Viewer. Section "Windows Logs->System". For each reboot you will find a lot records (Source column says Kernel-Power and/or Kernel-Boot) pertaining to the reboot/startup of the computer and 1 of them will show which application requested the reboot to happen. (Or if it was a crash the blue-screen crash information is logged in such a record.)

My guess is that it was probably Windows Update, because that will sometimes want to do an urgent reboot for highly critical security fixes.
It will give a notification that allows you to delay that reboot until later, but if you don't respond to that notification quickly (e.g. you are not at the computer at that time) it will reboot anyway.

After your edit: Could also have been a crash/bug bad enough to drag down the OS as a whole (aka a "blue screen").

Tonny
  • 31,463
  • 1
    @JavaSheriff Doesn't matter. The Event Viewer is still the place to look for logging that may shed more light on the reason for the reboot. – Tonny Dec 14 '23 at 14:41