# Windows 7 is shutting down unexpectedly, according to the logs

Here's a message from my eventvwr EventLog (Windows Logs > System):

The previous system shutdown at 11:51:15 AM on ‎7/‎29/‎2009 was unexpected.


This is funny because I was wondering why the system shut down while I was playing Civilizations IV full screen. Now I know. It was unexpected.

Has anyone encountered and resolved this?

## A little background:

I am running Windows 7 RC inside VMWare Fusion 2 (just updated a few months back) on a MacBook (Bitterly not Pro) aluminum-body. Windows 7 occasionally will shut down. This isn't a quick turn-off, it's a shutdown where all the programs are exited, the system waits until they quit (and Civ4 doesn't prompt me to save), it even installed Windows Updates before restarting. And yes it is restarting right after the shutdown. Because I run a game in full screen mode I do not notice any dialog with a countdown timer or anything like that that might be a warning.

As I have iStat on my dashboard widgets I can see about 8 temperature monitors. I have seen the CPU get up to 74C before, but during the shutdown, though it seemed hot to the touch (always is), it read 61C for the CPU, 60C for heatsink A, 50C for heatsink B and in the 30s-40s for the enclosure and harddrives. As I type this now, the temps are actually higher, so I don't think the temperature caused it.

I have at least six such events dating first from 5/17 which was a week after installing Windows 7.

I did find one information level warning from USER32 in the system log that says:

The process C:\Windows\system32\svchost.exe (DLAMBLIN-WIN7) has initiated the restart of
computer DLAMBLIN-WIN7 on behalf of user NT AUTHORITY\SYSTEM for the following reason:
Operating System: Recovery (Planned)
Reason Code: 0x80020002
Shutdown Type: restart
Comment:


And another 15 minutes before that from Windows Update:

Restart Required: To complete the installation of the following updates,
the computer will be restarted within 15 minutes:
- Cumulative Security Update for Internet Explorer 8 for Windows 7 Release Candidate
for x64-based Systems (KB972260)


Which I think kind of explains it. Though I don't know why restarting after an update would create an error event of "shutdown was unexpected", isn't that pretty odd?

Now, how do I set it to never restart after an update unless I click something.

## Application of solution:

As fretje reminded me, there's a couple of configurable settings for this, in windows 7 they're much in the same place as in Windows 2000 SP3 and XP SP1. Running gpedit.msc pops up a window that looks like:

Windows 7 has changed the order and added a couple of newer options I've italicized:

1. Do not display 'Install Updates and Shut Down' in Shut Down Windows dialog box
• Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog box
• Enabling Windows Power Management to automatically wake up the system to install scheduled updates
• Specify intranet Microsoft update service location
2. Allow Automatic Updates immediate installation
• Delay Restart for scheduled installations
• Reschedule Automatic Updates scheduled installations
• Enable Client Side targeting
• Allow signed updates from an intranet Microsoft update service

Personally I chose to enable 9, 11, 12, and 13. 9 enables only those updates that do not have to restart Windows nor stop a service. Enabling 11 actually disables the auto-restart. 12 and 13 were enabled and set to their max values with the scroll wheel. 16 sounds good but won't affect users lacking their own update server.

It's been pointed out that Home editions of Windows don't come with gpedit.msc, and you must therefore set things directly in the registry. There's probably more settings you could add besides NoAutoRebootWithLoggedOnUsers ... In fact I'm going to check that now. Okay in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU add:

1. AutoInstallMinorUpdates = 1
• NoRebootWithLoggedOnUsers = 1
• RebootRelaunchTimeout = 1440 (decimal)
• RebootRelaunchTimeoutEnabled = 1 [I'm actually curious if that's what I wanted]
• RebootWarningTimeout = 30 (decimal)
• RebootWarningTimeoutEnabled = 1 [I think the above four don't happen due to #2]
• dlamblin - It would seem to me that the format of this Q&A is lost. Would think that a comment on each person's answer below, if (Like I am guessing) you wished to expand on their information, instead of putting it in your "question", would have been more appropriate. Also, for the record, the information in the addendum, was added due to The How-To Geeks info. – user66001 Jun 3 '13 at 20:44
• @user66001 note that this question was asked in 2009 only shortly after comments were a feature. Because the FAQ at the time listed that each question should become an editable wiki-style page on the best answer(s) for the issue, I followed in the popular approach at the time of incorporating the best answers' information in one easy to read piece of prose. – dlamblin Jun 7 '13 at 0:49
• dlamblin - Ah, thanks for guessing that I didn't know this. It would seem right to now delete my comment, but hopefully you don't mind leaving it for others education also. Thanks. – user66001 Jun 7 '13 at 16:06
• Wow. This is terrible. That exact IE8 update is broken on my work computer, so when it "wakes up to install updates", it then crash-reboots. Thanks M\$. Also, kudos or hiding the s&#^% outta this setting and making it so things will only crash when unsupervised! – meawoppl Jul 18 '14 at 19:09