2

For roughly the last 3 months, nearly every night my Windows 10 64-bit Enterprise (1803) work computer is restarting. It is a 1 year old Dell Laptop, plugged into a 1 year old UPS. It works through daytime power outages without issue. It seems to be only after I lock the computer. If I leave it unlocked (it does not lock or sleep after a timeout), it doesn't appear to reboot (but I rarely do that so it's hardly a good indicator of anything). I was originally chalking this up to Windows Update, but after investigating it looks like that may not be the issue.

(I used these two posts to help investigate)

My event log is filled with "unexpected" shutdowns:

enter image description here

All the 6008 sources read the same:

The previous system shutdown at 10:10:21 PM on ‎10/‎31/‎2019 was unexpected.

The log entries from 1074 read:

The process C:\Windows\System32\RuntimeBroker.exe (xyz) has initiated the restart of computer xyz on behalf of user domain\user for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:

So I think those are likely candidates for Windows Update.

Crash dump

I used BlueScreenView to find a single crash dump, perhaps only the latest is kept:

Crash Time          Bug Check String        Bug Check Code  Parameter 1        Parameter 2          Parameter 3         Parameter 4         Caused By Driver
31-Oct-19 22:32:37  IRQL_NOT_LESS_OR_EQUAL  0x0000000a      00000000`00000000  00000000`00000002    00000000`00000000   fffff803`95a02266   ntoskrnl.exe

Ok, this seems to point to a device driver behaving badly. I do have the laptop plugged into about 50 USB devices. However, I was recently out without the docking station (just a mouse and a smart card reader) during the time period 21-25 OCT in the logs above, where restarts still happened.

But wait, there's more

Of course, there's a relevant caveat that makes this more complicated than it should be:

The Windows 10 1809 Feature update repeatedly fails to install due to a conflict with McAfee AV software, but they are both organizationally managed and I cannot deconflict them. So it tries to install every once in a while and fails. That I can understand (in a hollow bureaucratic way). What I can't understand is what's causing the computer to "unexpectedly" restart, sometimes multiple times, but only at night/when I lock my computer.

Conclusion

I figure I'm pretty much SOL. I work remotely but I cannot access the BIOS or change Windows Update settings, get rid of McAfee AV (which is working alongside Windows Defender ). My org's IT Support won't help for such a vague problem, even less for a vague problem on a remote laptop.

So just putting this out there in case anyone has any insight or to commiserate.

Nick
  • 678
  • 1
  • 9
  • 18
  • 1
    IMHO you should get the PC to your admins and advice them to provide a fresh Windows 1809 or 1903 installation. If the allow to install a new Windows version while McAfee prevents the installation but has to be installed it is their job to solve the "update deadlock" situation. If they don't allow 1809 they should block it via WSUS server. – Robert Nov 01 '19 at 17:25
  • Do you have Admin permissions on Windows? If not, demand it, because otherwise there is nothing that you can fix. – harrymc Nov 01 '19 at 18:16
  • @Nick Does the battery backup connect by USB to the laptop? If so, is that USB connecting through a hub? – K7AAY Nov 01 '19 at 18:52
  • @Robert It's interesting, we have our own WSUS server setup but this update was pushed out. I should report that too them as well but I've been creating issues for various things and didn't want to become "that user", having worked at a support position previously. – Nick Nov 01 '19 at 19:11
  • @K7AAY Yes, and yes. It's connected via the Dell Monitor USB 3.0 hub. I will disconnect it and see what happens over the weekend. – Nick Nov 01 '19 at 19:12
  • @harrymc Yes I do have admin rights. – Nick Nov 01 '19 at 19:15
  • The unexpected restart that you are experiencing is probably related to your system trying to install an update and failing. So you could download the ISO for Windows 10 version 1903 and do offline upgrade in Safe mode where McAfee can't interfere, if you can boot into Safe mode. – harrymc Nov 01 '19 at 19:20
  • @K7AAY I've had the UPS' USB cable disconnected for a 3 days now, and no restarts. I will leave it unplugged for a while to increase confidence in it being the culprit. Any reason why you asked about the UPS being connected through a hub? – Nick Nov 07 '19 at 13:58
  • @Nick Why? I grew up in an area subject to _frequent_ power outages (Zap Central, aka the Florida Everglades) so I worked with battery backups a lot. The battery backup (not really a UPS, pls forgive my purist 'tude about this) has the ability to force a shutdown when its battery runs low. I figured, you'd be safe testing without it since the laptop has its own battery and will keep running through short-to-medium duration outages. And, it had not been checked for possible malfs, so I thought, why not test it? – K7AAY Nov 07 '19 at 16:32

1 Answers1

1

Your battery backup has the ability to send a shutdown command if it senses its charge is low. If the battery in that device is failing or its controller is malfunctioning, it could be forcing a shutdown.

Since the laptop has its own battery and will keep running through short-to-medium duration outages, please disconnect the USB cable to the battery backup and monitor the system for several nights to resolve this unasked-for overnight shutdown.

K7AAY
  • 9,512
  • 4
  • 33
  • 62
  • But the UPS/battery backup should be sending "do a clean shutdown please" signals to the OS, right, not "restart uncleanly"? – Nick Nov 07 '19 at 22:20
  • I mean to say, it could be the driver of the UPS is crashing and taking the OS with it, the OS is just rebooting after a crash. – Nick Nov 07 '19 at 22:20
  • @Nick Maybe yes, maybe no. Don't know which brand, nor the model, nor do I know if the backup device or the USB cable has been abused. – K7AAY Nov 07 '19 at 22:32