Windows Update for Business "Select a time" option for reboots

[mfreedberg]

When a user chooses to schedule a reboot following a Windows Update (using WUfB), does Windows record what date and time the user selected for the reboot?

Does Windows also record a specific Event Log entry for that scheduled reboot so that we can correlate the date & time the user selected with the actual time the system rebooted?

We have seen a few cases now where the user opted to reboot at 5:45 pm, but the system actually rebooted at 5:30pm, which one could describe as "unexpected". We are looking for a way to audit what the person may have selected and when the machine actually executed the scheduled reboot.

[#2]

@mfreedberg Sorry I can't readily say where it's stored.  I proposed the option of filing the issue via Windows Feedback Hub or Support for investigation.  Another option would be to use a tool like Process Monitor - Windows Sysinternals | Microsoft Docs to track down the log or registry entry being sent.

HTH,

-Kevin

[#3]

@Kevin Mineweaser thanks for that, we can certainly try using ProcMon to capture any changes that the date/time selection might be storing! I assume that the scheduled reboot also creates a scheduled task, maybe that is the true "entry of record" for the requested reboot time?