This is for windows. One customer would log in (and me several times) and you are immediately assaulted with windows threatening you that you have 5 minutes and the system will reboot. No recourse, no mercy – for you OR those working on the server. Great – good customer service right? Well – it is windows that is causing the issue of course, not me. First, there are 2 GPO’s (link one, link two) that must be configured to ensure that the use has up to 180 minutes of warning, next to allow the reboot to happen at 3am for pete’s sake. Next, you should set up a log to emall you when events 6005/6006 to see when the even log was started and stopped. This is the same as you computer rebooting. Next, look for event 491 so see when patches are downloaded. Another blog article I wrote has a few other handy GPO’s as well that I suggest.