Management agent uncontroled restarted some computers after windows critical update

[Waldek 0]

Hi

We use endpoint in version 7.3.2041 and file security in version 7.2.12004.2. We also use management agent and security management console. Today we have situation where some computers and one server restarted after windows critical update. In system log I have found something like this:

The process C:\Program Files\ESET\RemoteAdministrator\Agent\ERAAgent.exe ... has initiated the restart of computer ...I on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Security fix (Planned)
Reason Code: 0x80020012
Shutdown Type: restart

We use standard settings without any special politics. My question is why agent forced restart some computers and where in politics can I disable such behaviour??

Greetings

Waldek

 

 

[Marcos 5,070]

If you sent an operating system update task to the client, probably you also checked the box to allow reboot. Could you confirm?

[Waldek 0]

Thanks for your answer.

Unfortunately I heven't used any operating system based tasks.

 

[MartinK 378]

I would recommend to open support ticket and collect required logs as soon as possible so that they are not missing for analysis. Currently AGENT is performing restart only when:

• requested by administrator via "shutdown/reboot task"
• required by installer, i.e. after software  is installed via installation task with enabled "reboot if required"
• indirectly after applying operating system updates. This should happen only in case OS update task is executed, and with enabled reboot. In this case, reboot is actually performed by operating system itself, but I guess it should happen only in case it was approved.

From provided logs it seems that last one caused errors. Could you please double check in respective "Client tasks" screen hat there is no operating system update task created? It might have been created as one-click action over device reporting outdated operating system. If task is present, I would also recommend to check what other triggers are possibly used, and also verify task configuration, especially reboot flag.