Welcome!

By registering with us, you'll be able to discuss, share and private message with other members of our community.

SignUp Now!

Detecting a forced windows restart

Dec
54
2
Hi folks, it's been a LONG time since I've been here!

Topic: How to detect (and log) when another application forces a windows restart?

Scenario: I work heavily in my privately licensed copy of TCmd in my job as software engineer. I have it set up so that my command log has in it only "major" events so I can use it to recollect what I might have done two days ago, or what kinds of system interruptions have occurred (WAN connection lost and restored, that sort of thing). Sometimes our IT remotely forces a reboot using a small application we have installed. (I don't have info on that application at present, but I can get it.) When this happens, it is sometimes hard to distinguish between a forced reboot in my absence, a system reboot due to a crash, or something else having happened.

I'd really like to get some details into the command log when that happens, so that I'm not faced with a mystery that I "just have to accept." (Obviously this is not possible during a system crash, but if I can log other scenarios, then the absence of those logs would clearly indicate "system crashed.")

How can I detect when another application forces a windows restart? Preferably, I'd like a belt-and-suspenders approach so that it doesn't matter WHICH application forces it, it gets logged.


Thanks, folks! Hope this is an interesting problem that will be useful to others!
 
This is very speculative. Apparently, Windows allows shutdown scripts. Configure them here:

1746543828556.webp


If you can get a shutdown script to run under TCC you might be able to collect enough information to let you figure out what happened.
 
At least sometimes the event log has information about restarts. Here's one entry.

Log Name: System
Source: User32
Date: 2025-05-05 08:51:40
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: JJ\vefatica
Computer: jj
Description:
The process C:\WINDOWS\system32\MusNotificationUx.exe (JJ) has initiated the restart of computer JJ on behalf of user JJ\vefatica for the following reason: Operating System: Service pack (Planned)
Reason Code: 0x80020010
Shutdown Type: restart
Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="User32" Guid="{b0aa8734-56f7-41cc-b2f4-de228e98b946}" EventSourceName="User32" />
<EventID Qualifiers="32768">1074</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2025-05-05T12:51:40.2700153Z" />
<EventRecordID>99820</EventRecordID>
<Correlation />
<Execution ProcessID="828" ThreadID="3984" />
<Channel>System</Channel>
<Computer>jj</Computer>
<Security UserID="S-1-5-21-3156152751-4120801034-2541390100-1001" />
</System>
<EventData>
<Data Name="param1">C:\WINDOWS\system32\MusNotificationUx.exe (JJ)</Data>
<Data Name="param2">JJ</Data>
<Data Name="param3">Operating System: Service pack (Planned)</Data>
<Data Name="param4">0x80020010</Data>
<Data Name="param5">restart</Data>
<Data Name="param6">
</Data>
<Data Name="param7">JJ\vefatica</Data>
</EventData>
</Event>
 
Back
Top