This post has been republished via RSS; it originally appeared at: Configuration Manager Archive articles.
First published on TECHNET on Jun 09, 2014
https://blogs.technet.microsoft.com/umairkhan/2014/06/09/configmgr-client-reboot-internals-for-update-deployments/
Hi Folks,
There are many a times we get into an issue where the ConfigMgr client gets rebooted even when the deployments were suppressed. So I am involving a case study to better understand the internals and how to track the issue.
Definitely the first thing to check is the deployments targeted and verify the Suppressed reboot settings for the Deployments. To verify the deployments targeted check WMI namespace – root\ccm\policy\machine\actualconfig – CCM_UpdateCIAssignment class. The class contains the assignment unique GUIDs. But if the deployment settings were later modified to check the ‘Suppress Reboot’ for clients then it can become a little difficult to troubleshoot the issue as we don’t track specific change settings and we will be only notified there was a change in the deployment.
Case Study-
I see that the machine rebooted with a deadline time after the updates were installed.
UpdatesDeployment.log:
No installations in pipeline, notify reboot. UpdatesDeploymentAgent 5/9/2014 8:38:55 AM 6488 (0x1958) Notify reboot with deadline = Friday, May 09, 2014. - 08:38:56, Ignore reboot Window = False UpdatesDeploymentAgent 5/9/2014 8:38:56 AM 6488 (0x1958)
RebootCoordinator.log:
Entered ScheduleRebootImpl - requested from 'UpdatesDeploymentAgent'. Rebootby = 1399646336. RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Successfully persisted reboot information to the registry RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Scheduled reboot from agent UpdatesDeploymentAgent. Deadline local time: 05/09/2014 08:38:56 AM RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Entered timer evaluation. RebootBy = 1399667936. UTC time 05/09/2014 02:38:56 PM RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Oops, past deadline, need to reboot RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) No CCM Identification blob RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Not in Service Mode, check ServiceWindowsManager next RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) ServiceWindowsManager has allowed us to Reboot RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) MTC task does not exist. Creating new request. RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Created MTC task '22aa28d5-b979-4141-ac08-648b8bc37879' RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) MTC allowed us to reboot RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Raising client SDK event for class NULL, instance NULL, actionType 4l, value 1399646336 5400 900, user NULL, session 4294967295l, level 0l, verbosity 30l RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Notified UI grace period start with 5400 grace seconds and 900 final seconds. RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) We can start the grace period now RebootCoordinator 5/9/2014 8:38:56 AM 6488 (0x1958) Received a MTC notification from ccmexec RebootCoordinator 5/9/2014 8:38:56 AM 1044 (0x0414) Entered timer evaluation. RebootBy = 1399667936. UTC time 05/09/2014 02:38:56 PM RebootCoordinator 5/9/2014 9:53:56 AM 7940 (0x1F04) Oops, past deadline, need to reboot RebootCoordinator 5/9/2014 9:53:56 AM 7940 (0x1F04) MTC task for reboot '22aa28d5-b979-4141-ac08-648b8bc37879'. Checking if it can run now... RebootCoordinator 5/9/2014 9:53:56 AM 7940 (0x1F04) MTC allowed us to reboot RebootCoordinator 5/9/2014 9:53:56 AM 7940 (0x1F04) Reboot Message: Your computer will restart at 05/09/2014 10:08:56 AM to complete the installation of applications and software updates. RebootCoordinator 5/9/2014 9:53:56 AM 7940 (0x1F04) System reboot request succeeded. RebootCoordinator 5/9/2014 9:53:56 AM 7940 (0x1F04) Reboot initiated RebootCoordinator 5/9/2014 9:53:56 AM 7940 (0x1F04)
I see that the machine installed the updates from the deployment and got the *Mandatory* Reboot notification.
Mandatory because it immediately scheduled the reboot with a deadline. Rebootby = 1399646336 this value is a timestamp value which you can convert into the UTC time (2:38 PM) and then we get a grace period (5400 sec) + 15 minutes (900 sec) before reboot.
I did a repro of the issue in my lab with suppressed reboot checked in the deployment (I also had verbose logging enabled for the client) and here were what my results were –
User S-1-5-21-1659472190-2775049323-3928745667-500 is getting pending reboot information... RebootCoordinator 5/17/2014 2:01:18 AM 2556 (0x09FC) Entered ScheduleRebootImpl - requested from 'UpdatesDeploymentAgent'. set Rebootby = 0. set NotifyUI = True. set PreferredRebootWindowType = 4 RebootCoordinator 5/17/2014 2:52:33 AM 3820 (0x0EEC) Successfully persisted reboot information to the registry RebootCoordinator 5/17/2014 2:52:33 AM 3820 (0x0EEC) Scheduled non mandatory reboot from agent UpdatesDeploymentAgent RebootCoordinator 5/17/2014 2:52:33 AM 3820 (0x0EEC) UI REBOOT SCHEDULED: Telling UI that a reboot has been scheduled RebootCoordinator 5/17/2014 2:52:33 AM 3820 (0x0EEC)
The Rebootby flag is 0 meaning a Non-Mandatory reboot. The registry mentioned here is the one which stores the information –
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData
Some more explanation for ScheduleRebootImpl–
ScheduleRebootImpl is used to schedule a mandatory or non-mandatory reboot. If RebootBy is 0, then it is a non-mandatory reboot, otherwise the number represents a date/time in time_t format by when the reboot should occur. Success will be returned if an earlier reboot is already scheduled. If -1 is passed to RebootBy, a reboot will happen immediately (with grace period), without countdown.
So the deployment that was targeted (or the previous deployments on the machine) was not having the ‘Suppressed Reboot’ checked which caused it to schedule the reboot immediately.
I had one more requirement on the Windows APIs being called for the Reboot.
For Vista and Higher we use InitiateShutdown() api to restart.
For any lesser than that we use standard InitiateSystemShutdownEx() api to restart.
Both of these we Windows APIs more information this -
InitiateShutdown() - http://msdn.microsoft.com/en-us/library/windows/desktop/aa376872(v=vs.85).aspx
InitiateSystemShutdownEx() - http://msdn.microsoft.com/en-us/library/windows/desktop/aa376874(v=vs.85).aspx
Now the next question that comes is what FLAGS are set for these APIs for the reboot. To which the answer is we set all the 4 below flags for dwRebootFlags
SHUTDOWN_FORCE_OTHERS
| SHUTDOWN_FORCE_SELF
| SHUTDOWN_RESTART
| SHUTDOWN_RESTARTAPPS
Hope this helps.
Umair Khan
Support Escalation Engineer | Microsoft System Center Configuration Manager
Disclaimer: This posting is provided "AS IS" with no warranties and confers no rights.