Confused - why did my Windows 10 restart even though no update recorded?

I just witnessed some very strange behavior on my Windows 10 Home machine. I locked the laptop to go for dinner, and when I came back and unlocked it, it was obvious that Windows had restarted. Excel and Word opened up with recovery saves, some other programs were closed altogether, some programs that usually boot up together with the system were running despite I had closed them before.

I logged on at ~ 19:00 of 25/02. I locked the laptop 1-2 hours before, so the problem must have occurred in that time. Below some Event Viewer infos (system logs; I can also post application log if necessary):

Error 25/02/2018 19:13:01 DistributedCOM 10016 None
Error 25/02/2018 19:08:15 DistributedCOM 10016 None
Information 25/02/2018 19:06:44 Service Control Manager 7040 None
Information 25/02/2018 19:04:22 Service Control Manager 7040 None
Warning 25/02/2018 19:01:42 Netwtw04 6105 None
Information 25/02/2018 19:01:02 Service Control Manager 7040 None
Warning 25/02/2018 19:00:53 Netwtw04 6105 None
Error 25/02/2018 19:00:11 DistributedCOM 10010 None
Information 25/02/2018 18:58:25 Service Control Manager 7040 None
Error 25/02/2018 18:58:20 DistributedCOM 10016 None
Error 25/02/2018 18:58:19 DistributedCOM 10016 None
Information 25/02/2018 18:58:17 FilterManager 6 None
Information 25/02/2018 18:58:17 Kernel-General 16 None
Information 25/02/2018 18:58:17 Kernel-General 16 None
Information 25/02/2018 18:58:17 Kernel-General 16 None
Information 25/02/2018 18:58:10 Kernel-General 16 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Error 25/02/2018 18:58:09 DistributedCOM 10016 None
Information 25/02/2018 18:58:08 Kernel-General 16 None
Information 25/02/2018 18:58:06 Kernel-General 16 None
Information 25/02/2018 18:58:04 Kernel-General 16 None
Information 25/02/2018 18:58:04 Kernel-General 16 None
Error 25/02/2018 18:58:00 DistributedCOM 10016 None
Error 25/02/2018 18:58:00 DistributedCOM 10016 None
Information 25/02/2018 18:58:00 UserModePowerService 12 (10)
Information 25/02/2018 18:58:00 Kernel-General 16 None
Information 25/02/2018 18:58:00 Kernel-General 15 None
Information 25/02/2018 18:58:00 Winlogon 7001 (1101)
Information 25/02/2018 18:09:56 Service Control Manager 7040 None
Information 25/02/2018 18:07:53 Service Control Manager 7040 None
Error 25/02/2018 18:07:41 DistributedCOM 10010 None
Information 25/02/2018 18:05:46 TPM-WMI 1025 None
Information 25/02/2018 18:05:46 Kernel-General 16 None
Information 25/02/2018 18:05:44 TPM-WMI 1025 None
Information 25/02/2018 18:05:42 TPM 18 None
Information 25/02/2018 18:05:41 Service Control Manager 7040 None
Information 25/02/2018 18:05:41 Kernel-General 16 None
Warning 25/02/2018 18:05:41 WHEA-Logger 17 None
Warning 25/02/2018 18:05:41 WHEA-Logger 17 None
Warning 25/02/2018 18:05:41 WHEA-Logger 17 None
Warning 25/02/2018 18:05:41 WHEA-Logger 17 None
Warning 25/02/2018 18:05:41 WHEA-Logger 17 None
Warning 25/02/2018 18:05:41 WHEA-Logger 17 None
Information 25/02/2018 18:05:41 Service Control Manager 7026 None
Information 25/02/2018 18:05:40 WLAN-AutoConfig 4000 None
Information 25/02/2018 18:05:39 Kernel-General 16 None
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 FilterManager 6 None
Information 25/02/2018 18:05:39 FilterManager 6 None
Information 25/02/2018 18:05:39 FilterManager 6 None
Information 25/02/2018 18:05:39 Lfsvc 2 None
Information 25/02/2018 18:05:39 FilterManager 6 None
Information 25/02/2018 18:05:39 DHCPv6-Client 51046 Service State Event
Information 25/02/2018 18:05:39 Dhcp-Client 50103 Service State Event
Information 25/02/2018 18:05:39 Dhcp-Client 50036 Service State Event
Information 25/02/2018 18:05:39 EventLog 6013 None
Information 25/02/2018 18:05:39 EventLog 6009 None
Information 25/02/2018 18:05:39 EventLog 6005 None
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 Kernel-General 16 None
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 UserModePowerService 12 (10)
Information 25/02/2018 18:05:39 Kernel-General 16 None
Information 25/02/2018 18:05:39 Kernel-General 16 None
Information 25/02/2018 18:05:39 Kernel-General 16 None
Information 25/02/2018 18:05:39 Directory-Services-SAM 16962 None
Information 25/02/2018 18:05:39 Kernel-General 16 None
Information 25/02/2018 18:05:39 Wininit 14 None
Information 25/02/2018 18:05:38 FilterManager 6 None
Information 25/02/2018 18:05:37 FilterManager 6 None
Information 25/02/2018 18:05:37 Kernel-General 16 None
Information 25/02/2018 18:05:37 BTHUSB 18 None
Information 25/02/2018 18:05:36 Kernel-General 15 None
Information 25/02/2018 18:05:34 Ntfs (Microsoft-Windows-Ntfs) 98 None
Information 25/02/2018 18:05:34 Kernel-Power 521 (220)
Information 25/02/2018 18:05:34 MEIx64 2 None
Information 25/02/2018 18:05:34 Ntfs (Microsoft-Windows-Ntfs) 98 None
Information 25/02/2018 18:05:34 Kernel-Power 521 (220)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 55 (47)
Information 25/02/2018 18:05:34 Netwtw04 7010 None
Information 25/02/2018 18:05:34 Ntfs (Microsoft-Windows-Ntfs) 98 None
Information 25/02/2018 18:05:34 Netwtw04 7001 None
Information 25/02/2018 18:05:34 Netwtw04 7036 None
Warning 25/02/2018 18:05:34 Kernel-PnP 219 (212)
Information 25/02/2018 18:05:34 DriverFrameworks-UserMode 10118 Startup of the UMDF reflector
Information 25/02/2018 18:05:33 Kernel-Power 172 (203)
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:33 Ntfs (Microsoft-Windows-Ntfs) 98 None
Error 25/02/2018 18:05:33 hpdskflt 1001 None
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:33 FilterManager 6 None
Information 25/02/2018 18:05:32 Kernel-Boot 30 (21)
Information 25/02/2018 18:05:32 Kernel-Boot 32 (58)
Information 25/02/2018 18:05:32 Kernel-Boot 18 (57)
Information 25/02/2018 18:05:32 Kernel-Boot 25 (32)
Information 25/02/2018 18:05:32 Kernel-Boot 27 (33)
Information 25/02/2018 18:05:32 Kernel-Boot 20 (31)
Information 25/02/2018 18:05:32 Kernel-Boot 153 (62)
Information 25/02/2018 18:05:32 Kernel-General 12 (1)
Information 25/02/2018 18:05:25 Kernel-General 13 (2)
Warning 25/02/2018 18:05:25 DNS Client Events 1014 (1014)
Information 25/02/2018 18:05:23 Kernel-Power 109 (103)
Information 25/02/2018 18:05:18 WLAN-AutoConfig 4001 None
Information 25/02/2018 18:05:17 EventLog 6006 None
Information 25/02/2018 18:05:17 Dhcp-Client 50037 Service State Event
Information 25/02/2018 18:05:17 Dhcp-Client 50106 Service State Event
Information 25/02/2018 18:05:17 DHCPv6-Client 51057 Service State Event
Information 25/02/2018 18:05:17 DHCPv6-Client 51057 Service State Event
Information 25/02/2018 18:05:17 DHCPv6-Client 51047 Service State Event
Information 25/02/2018 18:05:17 Dhcp-Client 50105 Service State Event
Information 25/02/2018 18:05:17 Dhcp-Client 50104 Service State Event
Error 25/02/2018 18:05:15 DistributedCOM 10005 None
Error 25/02/2018 18:05:14 Service Control Manager 7023 None
Information 25/02/2018 18:05:13 Winlogon 7002 (1102)
Error 25/02/2018 18:05:13 DistributedCOM 10010 None
Error 25/02/2018 18:05:13 DistributedCOM 10010 None
Error 25/02/2018 18:05:13 DistributedCOM 10010 None
Error 25/02/2018 18:05:13 DistributedCOM 10010 None
Error 25/02/2018 18:05:13 DistributedCOM 10010 None
Error 25/02/2018 18:05:13 DistributedCOM 10010 None
Information 25/02/2018 18:05:00 User32 1074 None
Information 25/02/2018 18:01:22 Kernel-General 1 (5)
Information 25/02/2018 18:01:22 Time-Service 35 None
Information 25/02/2018 18:01:18 Kernel-General 16 None
Information 25/02/2018 18:01:07 Time-Service 37 None
Information 25/02/2018 18:01:06 Time-Service 158 None
Information 25/02/2018 18:01:01 Kernel-General 15 None
Information 25/02/2018 18:00:59 Kernel-General 16 None
Information 25/02/2018 18:00:58 Kernel-General 15 None
Information 25/02/2018 18:00:57 Kernel-General 16 None
Information 25/02/2018 18:00:57 Kernel-General 16 None
Information 25/02/2018 18:00:57 Kernel-General 15 None
Information 25/02/2018 18:00:50 Kernel-General 11 None
Information 25/02/2018 18:00:50 Kernel-General 11 None
Information 25/02/2018 18:00:50 Kernel-General 15 None
Information 25/02/2018 18:00:02 Service Control Manager 7040 None
Information 25/02/2018 17:57:37 Service Control Manager 7040 None
Information 25/02/2018 17:41:32 WindowsUpdateClient 19 Windows Update Agent
Information 25/02/2018 17:41:32 WindowsUpdateClient 43 Windows Update Agent
Information 25/02/2018 17:41:27 Service Control Manager 7040 None
Information 25/02/2018 17:41:27 UserPnp 20001 (7005)
Information 25/02/2018 17:41:27 Ntfs (Microsoft-Windows-Ntfs) 98 None
Error 25/02/2018 17:41:18 DistributedCOM 10016 None
Information 25/02/2018 17:33:01 Service Control Manager 7040 None
Information 25/02/2018 17:31:28 WindowsUpdateClient 44 Windows Update Agent
Error 25/02/2018 17:30:59 DistributedCOM 10016 None
Information 25/02/2018 17:28:02 UserPnp 20001 (7005)
Information 25/02/2018 17:28:02 UserPnp 20003 (7005)
Warning 25/02/2018 17:27:59 WHEA-Logger 17 None
Information 25/02/2018 17:27:57 Power-Troubleshooter 1 None
Information 25/02/2018 17:27:57 Service Control Manager 7040 None
Information 25/02/2018 17:27:55 Kernel-Boot 25 (32)
Information 25/02/2018 17:27:55 Kernel-Boot 27 (33)
Information 25/02/2018 17:27:55 Kernel-Boot 32 (58)
Information 25/02/2018 17:27:55 Kernel-Boot 18 (57)
Information 25/02/2018 17:27:55 Kernel-Boot 30 (21)
Information 25/02/2018 17:27:55 BTHUSB 18 None
Information 25/02/2018 17:27:54 UserModePowerService 12 (10)
Information 25/02/2018 17:27:54 UserModePowerService 12 (10)
Information 25/02/2018 17:27:54 UserModePowerService 12 (10)
Information 25/02/2018 17:27:54 EventLog 6013 None
Information 25/02/2018 17:27:53 Kernel-General 1 (5)

The weird thing is that in the Windows Update history, no system updates were intalled today. I have problems understanding what happened and would like to avoid that going forward. Any ideas what is off?

1 Answer

These look suspicious: Warning 25/02/2018 18:05:34 Kernel-PnP 219 (212) and Error 25/02/2018 18:05:33 hpdskflt 1001 None and this one may tell you why there was a reboot: Information 25/02/2018 18:05:00 User32 1074 None

Also, there definitely are some Windows update activity going on: Information 25/02/2018 17:41:32 WindowsUpdateClient 19 Windows Update Agent Information 25/02/2018 17:41:32 WindowsUpdateClient 43 Windows Update Agent

You checked the details for the User32 one which says:

The process c:\windows\system32\svchost.exe (LAPTOP-XX) has initiated the restart of computer LAPTOP-XX on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned) Reason Code: 0x80020010 Shut-down Type: restart Comment: The strange thing is still that there is no update listed in the Windows Update history...

This clearly says that a Windows Update/feature pack installation is responsible for the reboot. Note, these feature pack installations do not always show up in the Windows Update settings tab.