Im trying to explain why a server reboot upon login. The server was set via group policy to automatically update and install updates. But the policy "No auto-restart with logged on users for scheduled automatic updates installations" is enabled. So the server should not reboot. When an admin logged into the box, the system automatically rebooted. The user barely got a chance to see the desktop before the system stated it was shutting down. Looking at the event logs after the server restarts, i see the event (Event ID: 26) which shows that the OS asked the users "Other People are logged on to this computer. Restarting Windows Might cause them to lose data. Do you want to continue restarting?". But the user actually never saw the message. The next event log is the "The process wuauclt.exe has initiated the retart of computer..." on behalf of the user that just logged in. The reason code is 0x80020002. The event logs are 1 second apart before the questions was popped up and the system shutdown log. This has happened to two different admin users, when they logged into a live critical server and it just reboots at login. I have since disabled all automatic updates and automatic installations. Does anyone have an idea on why the question would be clicked yes before the user even sees the message?

1. GPO Allow Automatic Updates immediate installation Enabled Configure Automatic Updates Enabled Configure automatic updating: 4 - Auto download and schedule the install Scheduled install day: 0 - Every day Scheduled install time: 13:00 No auto-restart for scheduled Automatic Updates installations Enabled 2. Try the clean Windows start 3. What is resulting GPO on both computers? How they differ from the "healthy" ones? 4. I han an issue with automatic restart some times ago, when I wrongly ghosted images, in this case I could make changes in disk designation remotely in the registry. PS: I use WSUS, start all computers in BIOS, let computer to update, and shutdown them after that.