9 Replies Latest reply on Jul 5, 2016 8:14 AM by cwinning

    Multiple Server Reboots

    PaulFreedman Apprentice

      Last night we deployed a number of patches in one deployment, after completing some of the servers rebooted multiple times for example one server rebooted 3 times while some rebooted twice, others just once?!

       

      Looking through the event logs I can see the following, first reboot is triggered by Shavlik but the following 2 are triggered by TrustedInstaller.exe

      Capture4.PNG

      Capture5.PNG

      Is this expected behaviour? As a side note we are currently running Shavlik Protect Standard 9.2.0 Build 5057

        • 1. Re: Multiple Server Reboots
          gforsythe Rookie

          If the servers are on different OS versions, service packs, etc, or at different patch stages, or have different services and/or features, they could indeed need different reboot numbers to complete.  It's rare in my experience that a server needs 3, but fairly common for them to need 2. We of coarse all know that most need at least 1.

          • 2. Re: Multiple Server Reboots
            cwinning CommunityTeam

            Hello,

             

            Protect scan results will only show patches that can be installed together with a single reboot, so this is very much unexpected behavior.  All reboots initiated by Protect use the SafeReboot executable which can be seen in the screenshot, that 2nd reboot was initiated by the Windows's TrustedInstaller.exe which we don't use since we suppress reboots with switches.  This would indicate patches are being installed outside of Protect.  Verify Windows Update is set to never check for updates and that the WUSA agent isn't install.

             

            The multiple reboots are normally seen when Windows Update is doing all the work, we suppress the reboot until the very end.

             

            That being said, it's possible we missed 'norestart' switch on a patch, but I can't remember the last time this has happened.

             

            Thanks,

            Charles

            • 3. Re: Multiple Server Reboots
              gforsythe Rookie

              That makes sense, and give me a deeper understanding of what is occuring.  THANKS!

              • 4. Re: Multiple Server Reboots
                PaulFreedman Apprentice

                Hi Charles,

                 

                Windows Update is already set to Never check for updates, checked when the last check was and it was 2014 so nothing to do with something else installing patches.

                 

                I did notice that 3 patches failed, could this have affected it?

                 

                Looking at logs possibly missing no restart from one patch?

                 

                2016-06-28T18:36:16.7807393Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows-KB890830-x64-V5.37.exe /Q), nShow: true.

                2016-06-28T18:42:41.8388689Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3139923-v2-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T18:45:42.9075305Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\npp.6.9.2.Installer.exe /S), nShow: true.

                2016-06-28T18:46:03.5505641Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3125574-v4-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:25:06.0222040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\7z1602-x64.msi /qn /norestart), nShow: true.

                2016-06-28T19:25:12.5430040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\7z1602.msi /qn /norestart), nShow: true.

                2016-06-28T19:25:41.9958040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3164033-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:31:30.8118040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3164035-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:35:16.7466040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3159398-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:38:09.2514040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3161561-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:41:57.1986040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3161664-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:44:26.6310040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3161958-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:48:59.7714040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3161949-x64.msu /quiet /norestart), nShow: true.

                2016-06-28T19:53:34.8930040Z 1f68 V UnScriptedInstallation.cpp:29 Executing (C:\Windows\ProPatches\Patches\Windows6.1-KB3162835-x64.msu /quiet /norestart), nShow: true.

                • 5. Re: Multiple Server Reboots
                  cwinning CommunityTeam

                  Hello,

                   

                  A failed patch install wouldn't force a restart, the install would fail and the next patch would attempt to install.  Also, none of the times correlate to the trustedinstaller initiated restart.  Windows-KB890830-x64-V5.37.exe /Q and npp.6.9.2.Installer.exe /S don't require the /norestart since it doesn't force a restart. 

                   

                  Do you see anything installing in the %windir%\Windowsupdate.log on the target around 06/28/2016 22:09?

                   

                  Thanks,

                  Charles

                  • 6. Re: Multiple Server Reboots
                    PaulFreedman Apprentice

                    I think the time in the log above is actually out by an hour, probably BST so should be +1hour.

                     

                    I checked the windowsupdate.log and there is nothing between 20:59-22:21 which is when the 3 reboots took place.

                    • 7. Re: Multiple Server Reboots
                      cwinning CommunityTeam

                      Hello,

                       

                      Are you using agents or is this agentless?

                       

                      Charles

                      • 8. Re: Multiple Server Reboots
                        PaulFreedman Apprentice

                        Hi,

                         

                        This is agentless

                        • 9. Re: Multiple Server Reboots
                          cwinning CommunityTeam

                          Hello,

                           

                          OK, I'm out of ideas with the information I have.  It's probably going to take a WebEx with support\backline support to verify what caused the reboot.

                           

                          Would you be willing to work with Support on this?  Referencing this post will speed up of escalation process.

                           

                          Support Portal

                           

                          Thanks,

                          Charles