Main Area and Open Discussion > General Software Discussion

How can I find out what is restarting my PC automatically?

<< < (11/13) > >>

CWuestefeld:
Do you have the system set to auto-update, (default is 3am everyday)?
-4wd (November 27, 2013, 05:00 AM)
--- End quote ---

It seems that a couple of months ago, Windows did something that switched both my PC and my wife's to auto-update. That setting had previously been turned off (because it's evil), but it got turned back on somehow. I'm not sure if it's due to something that happened as a result of a previous Windows Update, or maybe because I had recently dropped both machines out of our domain, into a workgroup.

dr_andus:
It seems that a couple of months ago, Windows did something that switched both my PC and my wife's to auto-update. That setting had previously been turned off (because it's evil), but it got turned back on somehow.
-CWuestefeld (November 27, 2013, 12:44 PM)
--- End quote ---

Interesting. That would explain why it hasn't bothered me before (I bought this PC 3 yrs ago, which is when I would have set the auto-update settings to "download updates but let me choose") and make me look less of an amateur (which I nonetheless still am). :)

MilesAhead:
Pretty soon the way it's going all the settings will be for placebo effect only.  Bill Gates to staff "Let them click on whatever they want!! But we'll still do the right thing."   :)

4wd:
Also IIRC it reports in UTC so the disparity should match your time zone offset.-Stoic Joker (November 26, 2013, 07:02 AM)
--- End quote ---

Just had another look at uptime and it is reporting in the local timezone, (even though it can't identify it):



But as I was matching up times trying to see the discrepancies I noticed the filter I made wasn't giving system boot events  :-\

NOTE: This is for Windows 7.

Anyway, the new improved filter:
Sources: EventLog, Kernel-Boot, Kernel-BootDiagnostics, Kernel-General, Kernel-Power, Power-Troubleshooter,USER32
Event IDs: 1,12,13,41,42,109,1073,1074,6008
Event Level: Critical, Error, Warning, Information

The Event IDs were picked out of my Event Log from power events, etc - some Event IDs mean more than one thing depending on the source, eg. Event ID 1
Source: Kernel-General = System time has changed
Source: Power-Troubleshooter = The system has resumed from Sleep

You could refine the xml so that certain Event IDs only pertain to specific sources but I didn't see enough clashes to warrant the effort, (on my machine anyway).

Short list of what the Event IDs are, (pertaining to startup/shutdown):
Event IDEvent TypeEvent SourceEvent1INFORMATIONPower-TroubleshooterThe system has resumed from Sleep12INFORMATIONKernel-GeneralThe operating system started at system time13INFORMATIONKernel-GeneralThe operating system is shutting down at system time41CRITICALKernel-PowerThe system has rebooted without cleanly shutting down first.42INFORMATIONKernel-PowerThe system is entering sleep.109INFORMATIONKernel-PowerThe kernel power manager has initiated a shutdown transition.1073WARNINGUSER32The attempt by user <user> to restart/shutdown computer <computername> failed1074INFORMATIONUSER32The process <processname> has initiated the power off of computer <computername> on behalf of user <user> for the following reason: ...6008ERROREventLogThe previous system shutdown at <time> on ‎<date> was unexpected.
If I find any more I'll add them.

Added: Event ID 6008

Also, over on p0w3rsh3ll there's a PowerShell script to retrieve the reboot history of Win7, (and Win 2008 R2), computers.  Providing you have the same login credentials on other computers on the network, it can get those too.

I've attached it below, you'd need to modify it to accept parameters or edit to add in other computer names, (hey, I'm lazy), as it'll just do the localhost if you currently run it.

dr_andus:
(see attachment in previous post)
Do you have the system set to auto-update, (default is 3am everyday)?

This isn't going to turn out to be something as simple as this all along is it?  :-\
-4wd (November 27, 2013, 05:00 AM)
--- End quote ---

Actually it didn't, in the end. I turned off the auto-update a few days ago, but I had a recurrence today. This time however I managed to catch it in the act. I awoke the PC, and as it was coming back to life, I unwisely tried to move one software window from one monitor to the next (using Winsplit Revolution's CTRL+ALT+arrow hotkey) before it fully woke up. At this point all three screens went blank (the grey colour of my desktop) and stayed that way. I unplugged and replugged the  DisplayPort to VGA Video Adapter Converter, but it didn't make a difference. After a while suddenly the Windows login box popped up, which surprised me, as I didn't see any signs of rebooting.

When I checked Reliability History, it said "Windows Logon Application stopped working." The ACEEEvent log was full of all kinds of ATI and CCC.exe errors, as usual.

I think I have figured out two things here:

1) The problem does seem to point to the ATI graphics card (and possibly the adapter for the 3rd monitor); and

2) there doesn't seem to be an actual complete reboot involved!! I don't hear all the usual reboot noises (fan etc.), it just seems to restart Windows somehow and asks me to log back on. Could this be possible?

Navigation

[0] Message Index

[#] Next page

[*] Previous page