Windows Update for Business "Select a time" option for reboots

%3CLINGO-SUB%20id%3D%22lingo-sub-2146595%22%20slang%3D%22en-US%22%3EWindows%20Update%20for%20Business%20%22Select%20a%20time%22%20option%20for%20reboots%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2146595%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20a%20user%20chooses%20to%20schedule%20a%20reboot%20following%20a%20Windows%20Update%20(using%20WUfB)%2C%20does%20Windows%20record%20what%20date%20and%20time%20the%20user%20selected%20for%20the%20reboot%3F%3C%2FP%3E%3CP%3EDoes%20Windows%20also%20record%20a%20specific%20Event%20Log%20entry%20for%20that%20scheduled%20reboot%20so%20that%20we%20can%20correlate%20the%20date%20%26amp%3B%20time%20the%20user%20selected%20with%20the%20actual%20time%20the%20system%20rebooted%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20seen%20a%20few%20cases%20now%20where%20the%20user%20opted%20to%20reboot%20at%205%3A45%20pm%2C%20but%20the%20system%20actually%20rebooted%20at%205%3A30pm%2C%20which%20one%20could%20describe%20as%20%22unexpected%22.%20We%20are%20looking%20for%20a%20way%20to%20audit%20what%20the%20person%20may%20have%20selected%20and%20when%20the%20machine%20actually%20executed%20the%20scheduled%20reboot.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2146808%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20for%20Business%20%22Select%20a%20time%22%20option%20for%20reboots%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2146808%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F971180%22%20target%3D%22_blank%22%3E%40mfreedberg%3C%2FA%3E%26nbsp%3BSorry%20I%20can't%20readily%20say%20where%20it's%20stored.%26nbsp%3B%20I%20proposed%20the%20option%20of%20filing%20the%20issue%20via%20Windows%20Feedback%20Hub%20or%20Support%20for%20investigation.%26nbsp%3B%20Another%20option%20would%20be%20to%20use%20a%20tool%20like%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsysinternals%2Fdownloads%2Fprocmon%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EProcess%20Monitor%20-%20Windows%20Sysinternals%20%7C%20Microsoft%20Docs%3C%2FA%3E%26nbsp%3Bto%20track%20down%20the%20log%20or%20registry%20entry%20being%20sent.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHTH%2C%3C%2FP%3E%0A%3CP%3E-Kevin%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

When a user chooses to schedule a reboot following a Windows Update (using WUfB), does Windows record what date and time the user selected for the reboot?

Does Windows also record a specific Event Log entry for that scheduled reboot so that we can correlate the date & time the user selected with the actual time the system rebooted?

 

We have seen a few cases now where the user opted to reboot at 5:45 pm, but the system actually rebooted at 5:30pm, which one could describe as "unexpected". We are looking for a way to audit what the person may have selected and when the machine actually executed the scheduled reboot.

2 Replies

@mfreedberg Sorry I can't readily say where it's stored.  I proposed the option of filing the issue via Windows Feedback Hub or Support for investigation.  Another option would be to use a tool like Process Monitor - Windows Sysinternals | Microsoft Docs to track down the log or registry entry being sent.

 

HTH,

-Kevin

@Kevin Mineweaser thanks for that, we can certainly try using ProcMon to capture any changes that the date/time selection might be storing! I assume that the scheduled reboot also creates a scheduled task, maybe that is the true "entry of record" for the requested reboot time?