To trace the origin of the Reboot Prompts or reboot that could have been caused by Patching.
- Open Patch Manager > Devices window> Select the device that was prompted or rebooted> Patch Job (bottom pane)
- See if the Patch job timestamp matches the time for the reboot prompt and it indicates – “Updates require a reboot.”
- Check the LTPatching logs located at C:\Windows\Ltsvc\LTPatching.txt against the timestamp of the reboot prompt. Can see log entries like – Rebooting:::: Or a Rebooting:5:4: kind of message. (no message then it was not requested. This can be because outside of window, or one failed patch)
- If you see the rebooting instruction, look at agents Event Logs at that time frame to see if there is a reboot or restart requested on behalf of the LTAgent.
Outside of Patch Manager, there are monitors that would look for the Reboot Pending flag and prompt to reboot or reboot the computer based on the autofix action set up on the monitors.
Here is the list of out-of-the-box monitors that would have potentially prompted for a reboot or triggered the reboot:
UPDATES – Daytime Patch Reboot Pending
UPDATES – Reboot Pending
UPTIME – Over 1 Month Without Reboot
And depending on whether they are workstations or servers:
UPTIME – SVR 1 Month Since Reboot
UPTIME – WKS 2 Weeks Since Reboot
Please follow these steps to trace the monitor:
Open the Effective policy of a computer that got rebooted/prompted for reboot> Internal monitors
Check if any of the above-mentioned monitors are listed and if the Alert Template has an Autofix action
Double-click to open the monitor. Navigate to the History tab – to check for an entry matching the timestamp of the reboot/ reboot prompt
If you do not want the monitor to reboot or prompt for a reboot- edit the Autofix action set up in the alert template – to not run the Autofix action or change the alert template to “Default – Do nothing”
In order to exclude a computer from an internal monitor please follow the Exclusions Tab – Internal Monitor document.
I would request you to kindly check the commands or scripts ran on that machine during the time of the reboot.
Also, This may be a case of needing to add the registry key HKLM\SOFTWARE\LabTech\Service\Patches\ServerReboot with a Value of 0 so that it can be modified and set to 1 when a patch requiring a reboot is applied. Please test this with one of the machines that had an unexpected reboot and see if it still reboots.
Sorry for the inconvenience again. Please do let us know if you require any further assistance from us.