0

I was having issues with Windows 11 restarting by itself some months ago, which started happening after a Windows update, so it was obvious the update was bad, so with trial and error I found the culprits and uninstalled 2 updates and the problem disappeared.

The specifics to the issue was that it only happened in the mornings! Around 4 AM, which at those times I don't use the PC and it's just idle. The Event Viewer would have a log saying The computer has rebooted from a bugcheck.

Now after months, I updated Windows again and the issue is back. My PC restarted at 6 AM. I was wondering were those 2 updates that I uninstalled are now installed again with the new update?! Or is the new update alone causing this?!

So I searched on how to view Windows Update history logs:

Windows 11 PC restarted automatically?

https://winaero.com/find-windows-update-log-windows-10/

But what I need is some logs that will tell me:

  1. At date/time Windows installed KB* update.
  2. At date/time you uninstalled KB* update.

So I need to know the ID of the updates I uninstalled at that time, and this helps me troubleshoot and understand which update is bad. Last time I had to uninstall updates one by one and wait a day to see if PC crashes again or not, so knowing the ID's of the updates helps me find the bad updates faster.

I also looked at the issue itself, it's something related to ntoskrnl when I analyzed the dump with WinDBG and BlueScreenView (from Nirsoft) so I've already done all these:

https://www.auslogics.com/en/articles/fix-ntoskrnl-exe-bsod/

https://answers.microsoft.com/en-us/windows/forum/all/the-computer-has-rebooted-from-a-bugcheck/b905c715-e1e8-4d50-8e7f-46424a260deb

https://www.elevenforum.com/t/reccurring-bsod-on-bootup-ntoskrnl-exe-bugcheck-code-0xc000021a.18447/

https://learn.microsoft.com/en-us/answers/questions/1305411/how-to-fix-ntoskrnl-exe-and-wdf01000-sys-irql-not

https://forums.tomshardware.com/threads/bsod-caused-by-ntoskrnl-exe-on-pc-startup-or-shutdown.3714853/

https://forum-en.msi.com/index.php?threads/bsod-since-bios-update.356563/

https://www.tenforums.com/tutorials/5472-view-windows-update-history-windows-10-a-2.html

In short, I have done integrity verifications such as:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
chkdsk /r /f

I have also ran a Windows Memory Diagnostic and there were no issues, so I know this is not a hardware issue or software issue. It's just the Windows 11 update that is bad or incompatible with my MSI motherboard. One of the links above have suggested that a Windows update can cause this, so I'll leave it at that, don't want to unnecessarily update BIOS, MSI does not suggest that.

Shayan
  • 1,524
  • You can dump the Windows Update logs, but those logs are not kept, they are rolling. How far back your logs go will entirely depend on your system configuration. Get-WindowsUpdateLog. Have you asked for assistance with the problem you face instead of with the very high likelyhood, of something that cannot be dumped? Windows will install updates outside of activity hours, Windows Update History, would indicate if Windows was installing and crashing or installing and reverting. – Ramhound Mar 27 '24 at 12:26
  • I see. But I have to say I disable Windows Update service all the time and I only update when I want it to update. Windows did not revert anything. @Ramhound – Shayan Mar 27 '24 at 12:35
  • You watched the update install and crash? Have you disabled the automatic restart that is difficult but not impossible to disable on Windows 10+? It doesn’t sound like it if your crashes were happening in the morning outside of your active hours. – Ramhound Mar 27 '24 at 13:34
  • No it didn't crash during update. Yes the auto restart is disabled. But the updates are installed fine I think. I see what you mean now, I think the crashes happening in morning hours outside work hours are weird and could potentially mean that they have something to do with the updates but I don't have any pending updates, I even have paused the updates but still PC crashes in morning hours, what's with the morning hours really? Why does the PC crash only then? I will disable Windows Update Service to see if it still crashes tomorrow. @Ramhound – Shayan Mar 27 '24 at 13:51
  • 1
    The update(s) might have already been loaded into Windows, so it's trying to install them every night. Try to Clear the Software Distribution Folder. See also How to Hide/Stop/Block Specific Updates on Windows 10/11? – harrymc Mar 27 '24 at 14:06
  • 1
    Disabling the Service isn’t enough to prevent Windows Updates from being installed. – Ramhound Mar 27 '24 at 14:09
  • I didn't block Microsoft update, didn't clear Software Distribution folder, only uninstalled one update (it was named cumulative update for ...) and I forgot the ID of the update. And the PC didn't restart this morning so as I speculated the update was the issue. Now the original question was how to check logs/history for updates I have installed/uninstalled but Get-WindowsUpdateLog is too verbose I don't know how to read it. – Shayan Mar 28 '24 at 08:38

0 Answers0