Server 2008 and beyond have new behaviors regarding how reboots-after-patching are handled. In previous versions of Windows Server, the reboot happened exclusively according to the "Delay Restart for scheduled installations" setting. The default is usually 30 minutes after the installation is completed.
Since then, that restart is not automatic anymore. It is exclusively prompted and initiated by a logged on user. For up to 72 hours; if no user initiates the restart, the system automatically restarts at that point.
Determine that the server was rebooted by User32
1. Log into the affected Windows server and open up the Event Viewer
2. Navigate to Windows Logs > System > Filter Current Log and search for the Event ID: 1074
3. Results will appear as per the screen shot below. Refer to the reason code:
Update the Local Computer Policy to stop the server from rebooting
1. Run the command gpedit.msc. You will need to be an elevated user to manipulate Local Group Policy Editor.
2. Navigate to Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Update.
3. Double click on No auto-restart for scheduled Automatic Updates installations. Enable the policy and leave a comment.
