Step 1: Spot the Sneaky Restart in Event Logs (Skip the Freezing GUI)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,6008} -MaxEvents 20 | Sort-Object TimeCreated -Descending | Select-Object -First 1 TimeCreated, Id, LevelDisplayName, Message | Format-List
- What it does: Looks for “dirty” shutdowns (ID 41 or 6008). No results? Good news—your restart was “clean” (planned). (Mine showed nothing, so not a crash.)
Step 2: Dig for the Real Story with Broader Boot/Shut Logs
Get-WinEvent -FilterHashtable @{LogName='System'; ID=12,13,1074,6005,6006,6009} -MaxEvents 10 | Sort-Object TimeCreated -Descending | Format-Table TimeCreated, Id, LevelDisplayName, ProviderName, Message -Wrap
- Key IDs: 1074 reveals who restarted (e.g., “TrustedInstaller.exe… Operating System: Upgrade (Planned)”).
- The Culprit: TrustedInstaller (Windows Update’s installer) often forces an “upgrade” reboot. (Mine hit at 10:51 PM—classic move.)
Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime
Step 3: Lock Down Future Restarts (Microsoft’s Hidden Maze)
Quick Registry Shield (Copy-Paste PowerShell as Admin)
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoRebootWithLoggedOnUsers" -Value 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "AlwaysAutoRebootAtScheduledTime" -Value 0 gpupdate /force
- Why it works: Tells Windows “Don’t reboot if I’m logged in.” Verify with
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU".
Pro GUI Version (gpedit.msc)
- Run
gpedit.msc→ Computer Config → Admin Templates → Windows Components → Windows Update → Manage end user experience. - Enable Configure Automatic Updates → “2 – Notify download/install”. (This stops the OS from making decisions for you.)
- Enable Turn off auto-restart during active hours → Wide hours (e.g., 6 AM–11 PM).
gpupdate /force.
Nuclear Option: Tame Update Orchestrator
services.msc→ Update Orchestrator Service → Startup: Disabled → Stop.- No sneaky scheduling anymore (updates still work manually).
Why Microsoft Makes This So Hard (Minor Rant)
I get why the default configuration reboots on its own. Most users will never bother to check updates on their own, and if they are installed automatically but require a reboot, the message will be ignored by the general populace until the next upgrade. Anytime a non-technical friend or family member brings me a device that is giving them problems, finishing an update fixes it 92.8% of the time. But…
There’s a bunch of us nerds who came up from our basements (or down from the attic, in my case) and still want fine control over our own equipment without having to spend 4 hours on Google (or Gemini, or Claude, or…you get the idea). Or blowing up a movie theatre.
© Scott S. Nelson
