How to find cause of 'Unexpected' Windows restarts

2

For roughly the last 3 months, nearly every night my Windows 10 64-bit Enterprise (1803) work computer is restarting. It is a 1 year old Dell Laptop, plugged into a 1 year old UPS. It works through daytime power outages without issue. It seems to be only after I lock the computer. If I leave it unlocked (it does not lock or sleep after a timeout), it doesn't appear to reboot (but I rarely do that so it's hardly a good indicator of anything). I was originally chalking this up to Windows Update, but after investigating it looks like that may not be the issue.

(I used these two posts to help investigate)

My event log is filled with "unexpected" shutdowns:

enter image description here

All the 6008 sources read the same:

The previous system shutdown at 10:10:21 PM on ‎10/‎31/‎2019 was unexpected.

The log entries from 1074 read:

The process C:\Windows\System32\RuntimeBroker.exe (xyz) has initiated the restart of computer xyz on behalf of user domain\user for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:

So I think those are likely candidates for Windows Update.

Crash dump

I used BlueScreenView to find a single crash dump, perhaps only the latest is kept:

Crash Time          Bug Check String        Bug Check Code  Parameter 1        Parameter 2          Parameter 3         Parameter 4         Caused By Driver
31-Oct-19 22:32:37  IRQL_NOT_LESS_OR_EQUAL  0x0000000a      00000000`00000000  00000000`00000002    00000000`00000000   fffff803`95a02266   ntoskrnl.exe

Ok, this seems to point to a device driver behaving badly. I do have the laptop plugged into about 50 USB devices. However, I was recently out without the docking station (just a mouse and a smart card reader) during the time period 21-25 OCT in the logs above, where restarts still happened.

But wait, there's more

Of course, there's a relevant caveat that makes this more complicated than it should be:

The Windows 10 1809 Feature update repeatedly fails to install due to a conflict with McAfee AV software, but they are both organizationally managed and I cannot deconflict them. So it tries to install every once in a while and fails. That I can understand (in a hollow bureaucratic way). What I can't understand is what's causing the computer to "unexpectedly" restart, sometimes multiple times, but only at night/when I lock my computer.

Conclusion

I figure I'm pretty much SOL. I work remotely but I cannot access the BIOS or change Windows Update settings, get rid of McAfee AV (which is working alongside Windows Defender 🙄). My org's IT Support won't help for such a vague problem, even less for a vague problem on a remote laptop.

So just putting this out there in case anyone has any insight or to commiserate.

windows-10
bsod
crash
reboot
event-log
asked on Super User Nov 1, 2019 by Nick

1 Answer

1

Your battery backup has the ability to send a shutdown command if it senses its charge is low. If the battery in that device is failing or its controller is malfunctioning, it could be forcing a shutdown.

Since the laptop has its own battery and will keep running through short-to-medium duration outages, please disconnect the USB cable to the battery backup and monitor the system for several nights to resolve this unasked-for overnight shutdown.

answered on Super User Nov 7, 2019 by K7AAY

User contributions licensed under CC BY-SA 3.0