WUfB Notification Log files

[AndrewT]

Hi Team

In the middle of last year I moved my company to WUfB and it has been an overwhelming positive experience - we're seeing much improved update compliance and a better user experience!

From time to time I do have users claiming that they are getting rebooted without warning. Are there any logs on the Windows 10 side that show what notifications were shown to the user and what action they clicked? When these things happen I want to be able to built up a timeline of the notifications that they should of seen and at what time to help me understand what the issue might be.

Andrew

[#2]

@AndrewT 

There are a few things that could be happening, and we likely need some more information to narrow it down.

The first question is are the restarts happing during the middle of the day, or more specifically during Active Hours, or are they happening overnight.  The overnight restart is what we would generally expect to avoid restarts during Active Hours.   You may need to check the current active hours settings since there are a number of policies that can be set that can turn off active hours or set them to strange hours.

The other configuration to check is if you are using the Compliance Deadline, which is recommended to use and documented here https://aka.ms/WUfBComplianceDeadline (which also covers the restart dialog flow when this policy is set).  This can cause a restart during Active Hours, and is by design.

Hope this helps,

-David

[#3]

And I kept thinking and wondering what the problem might be. Now everything became clear to me. Thank you guys so much for solving these problems.

[#4 · Accepted solution]

Thanks@David_Guyer 

We run the same policies on all our other PCs (including my main PC) they don't experience the issues. I am pretty confident the policies and WUfB are working as expected and the user is not remembering they got the notifications. Or maybe we have a a full-screen app in that environment that could be interfering with them.

Being able to look at the log files would give a more definitive way for me to be able to prove which notifications they actually got. I did some extra research and found this article which describes some additional ETL log files to look at. I will figure out how to look through them for more info, and if I get stuck will log a support case :thumbs_up: