/build/static/layout/Breadcrumb_cap_w.png
12/04/2018 176 views
After running patch jobs where the force reboot option is selected, we get notified via SCOM on several servers msgs like: " The previous system shutdown at 5:13:21 PM on ‎12/‎4/‎2018 was unexpected". This would mean I assume the machine was not shut down clean. On some of these servers when you log in a window pops up asking you to enter a reason the computer was forced to shut down. So is KACE really forcing a reboot this way and is there any way to stop these dirty shut downs? Of course leaving the option of no reboot means someone has to go and reboot it then. For the most part, machines appear to shut down cleanly but these forced reboots are getting attention and people are complaining.  
0 Comments   [ + ] Show comments

Comments



Community Chosen Answer

2

Unexpected Shutdown simply means: It was not initiated by the user.
In the case of KACE it was initiated by the agent using the SYSTEM service.
The agent runs a "standard" shutdown /r, which safely ends all services and does a normal reboot.
Microsoft right now does not provide any other way to do this.
You can set a GPO to remove the message if the users don't understand the meaning of the popup.
The needed GPO is found under the Admin Templates: Display Shutdown Event Tracker


Answered 12/04/2018 by: Nico_K
Red Belt

  • Wouldn't every server be showing a Unexpected Shutdown if a user didn't initiate it? Or does this occur only if a user is logged in and didn't initiate it?
    • it is shown the users with admin rights

All Answers

1

Servers want a reason for shutdown/restart input to them.  You need to find out from Kace what switches are being added to the shutdown command they issue to force the restart.  You most likely will need to request that they add a comment or reason switch to the command they issue to stop this.

Usage: shutdown [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/soft] [/fw] [/f]
[/m \\computer][/t xxx][/d [p|u:]xx:yy [/c "comment"]]

No args Display help. This is the same as typing /?.
/? Display help. This is the same as not typing any options.
/i Display the graphical user interface (GUI).
This must be the first option.
/l Log off. This cannot be used with /m or /d options.
/s Shutdown the computer.
/sg Shutdown the computer. On the next boot,
restart any registered applications.
/r Full shutdown and restart the computer.
/g Full shutdown and restart the computer. After the system is
rebooted, restart any registered applications.
/a Abort a system shutdown.
This can only be used during the time-out period.
Combine with /fw to clear any pending boots to firmware.
/p Turn off the local computer with no time-out or warning.
Can be used with /d and /f options.
/h Hibernate the local computer.
Can be used with the /f option.
/hybrid Performs a shutdown of the computer and prepares it for fast startup.
Must be used with /s option.
/fw Combine with a shutdown option to cause the next boot to go to the
firmware user interface.
/e Document the reason for an unexpected shutdown of a computer.
/o Go to the advanced boot options menu and restart the computer.
Must be used with /r option.
/m \\computer Specify the target computer.
/t xxx Set the time-out period before shutdown to xxx seconds.
The valid range is 0-315360000 (10 years), with a default of 30.
If the timeout period is greater than 0, the /f parameter is
implied.
/c "comment" Comment on the reason for the restart or shutdown.
Maximum of 512 characters allowed.
/f Force running applications to close without forewarning users.
The /f parameter is implied when a value greater than 0 is
specified for the /t parameter.
/d [p|u:]xx:yy Provide the reason for the restart or shutdown.
p indicates that the restart or shutdown is planned.
u indicates that the reason is user defined.
If neither p nor u is specified the restart or shutdown is
unplanned.
xx is the major reason number (positive integer less than 256).
yy is the minor reason number (positive integer less than 65536).
Answered 12/04/2018 by: SMal.tmcc
Red Belt