Recently I’ve got unexpected Windows server 2008 R2 reboot with some recovery reason, which is quite uninformative:
The process C:\Windows\system32\svchost.exe (servername) has initiated the restart of computer servername on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Recovery (Planned)
Reason Code: 0x80020002
Shutdown Type: restart
Comment:
As time of reboot was very close to 03:00 AM (default windows update installation time) and System event log contained couple of events about update installation, I’ve decided to check WindowsUpdate.log file.
It has following:
2013-12-16 03:17:06:606 832 13c8 AU AU invoking RebootSystem (OnRebootNow)
2013-12-16 03:17:06:647 832 13c8 Misc WARNING: SUS Client is rebooting system.
2013-12-16 03:17:06:647 832 13c8 AU AU invoking RebootSystem (OnRebootRetry)
2013-12-16 03:17:06:651 832 13c8 AU AU received handle event
So to eliminate such unexpected reboots disable automatic updates for production servers, or deny it automatically reboot server.