Event Viewer System logs showing the following:
Event id: 1074
Reason Code: 0x80020002
The process C:\Windows\system32\svchost.exe has initiated the restart of computer xxxxx on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Recovery (Planned)
Thanks Ossian. I googled the reason code 0x80020002 and from what I’ve read, it’s a windows update reboot. This was also confirmed by the WindowsUpdate.log file. My understanding is if it was a user that rebooted it, it would show “on behalf of user ‘username'” not “on behalf of user NT AUTHORITY\SYSTEM”. What makes you believe it was a manual reboot?