Why did my Windows 10 restart?

Question

I did run my overnight computations and when I came to my computer, it is restarted :-( I would like to find reason why, if it was due to my computation process crashing or some system update. I have tried to look into the Event Log Viewer, Windows Logs -> System, but I cannot find the cause:

The computer must have restarted around 6:50. The last message before is at 6:03 from WindowsUpdateClient: "Installation Successful: Windows successfully installed the following update: Microsoft Advertising SDK for XAML". Then there are these messages (all at 6:51:13):

• Kernel-General: "The operating system started at system time ‎2016‎-‎07‎-‎02T04:51:13.490451600Z."
• Kernel-Boot: "The last shutdown's success status was false. The last boot's success status was true."
• Kernel-Boot: "The boot type was 0x0."
• Kernel-Boot: "The boot menu policy was 0x1."
• Kernel-Boot: "There are 0x1 boot options on this system."
• Kernel-Boot: "The bootmgr spent 0 ms waiting for user input."

How do I find out the cause of the restart? There is a possibility that it was due to update, but there was cca 50 minutes between the update and the restart. I would like to be really sure about the cause of the restart.

Answer 1

If windows update restarts your machine, you should see an event from user32 stating the reason for shutdown:

It's followed by a bunch of logoff messages, and finally Kernel-General saying something like: "The operating system is shutting down at system time ‎2018‎-‎09‎-‎13T00:40:12.484519400Z.", followed shortly by a corresponding startup message.

If you don't see those types of logoff messages, you probably had a crash, and may find related error events somewhere in the event viewer.

If I'm not sure when a restart happened, I look at the EventLog events at 12pm every day that show the system uptime:

All of these logs are found under Event Viewer/Windows Logs/System.

Answer 2

There are several signs your PC has crashed, including the message on how "The last shutdown's success status was false." Because Windows doesn't have additional information in the crash, it probably wasn't a BSOD.

Unfortunately, further diagnosis is pretty much impossible because you haven't witnessed it. However, it's most likely related to how your "overnight computations" excessively stressed the PC. There may be shortcomings in the cooling/ventilation setup. Other than that it could be pretty much any hardware component being subtly broken.

To illustrate how a successful reboot (preceded by a regular boot) looks like, take a look at this event log. Note how there are messages of some services (including the event logging service) being stopped.

Answer 3

I made a VBScript file and have a shortcut in the startup folder. This displays the most recent boot time. If I want to know why the machine rebooted I view all system events unfiltered, scrolling back from the last time shown by the script and usually can see what happened.

const ToRead = 1
const ToWrite = 2
const ToAppend = 8
const WindowsFolder = 0
const SystemFolder = 1
const TemporaryFolder = 2
for each item in getobject("winmgmts:{impersonationLevel=impersonate}!\\." & "\root\cimv2").ExecQuery("SELECT * FROM Win32_ComputerSystem") : time_zone_offset = item.CurrentTimeZone / 60 : next
set fso = createobject("Scripting.FileSystemObject")
temp_file = fso.getspecialfolder(TemporaryFolder)
if right(temp_file,1) <> "\" then temp_file = temp_file & "\"
temp_file = temp_file & "boot_times.$"
set ws = createobject("WScript.Shell")
ws.run "cmd /C wevtutil.exe qe System /q:""*[System [(EventID=6009)]]"" /rd >""" & temp_file & """", 0,true
build = "booted at"
with fso.opentextfile(temp_file,ToRead)
  while not .atendofstream
    a = .readline
    p = instr(a,"<TimeCreated SystemTime")
    if p > 0 then
      a = mid(a,p+25)
      p = instr(a,"'/>")
      if p > 0 then
        a = replace(left(a,p-1),"T"," ")
        p = instr(a,".")
        if p > 0 then
          a = left(a,p-1)
          if isdate(a) then
            dt = dateadd("h",time_zone_offset,cdate(a))
            build = build & vbcrlf & year(dt) & "-" & twodg(month(dt)) & "-" & twodg(day(dt)) & " " & twodg(hour(dt)) & ":" & twodg(minute(dt)) & ":" & twodg(second(dt))
            end if
          end if
        end if
      end if
    wend
  .close
  end with
fso.deletefile temp_file
msgbox build

function twodg(j)
  twodg = right("0" & j,2)
end function

Answer 4

Windows Update for Windows 10 was made to look for a time in which a user (like yourself) is not active, and begin updates then.

If needed, Windows 10 will also automatically restart at this time, which is likely what occurred in your case.

Alternatively, the system errored, BSoD'd or lost power and then started back up again afterwards. Given the lack of logs stating as such, I would assume that none of these actually happened.

Also, the log line you're showing here, "The operating system started at system time ‎2016‎-‎07‎-‎02T04:51:13.490451600Z.", states that the operating system started at 04:51:13, not 06.51.13.