Legacy API Shutdown

Hi all,

We have a file server, running W10 Pro 64b.
Yesterday and today afternoon the server went offline and didn't come
back. I had to pull the power cord out and in again and boot it up.
Today I checked the event viewer and saw "Legacy API Shutdown", with the
error code 0x8007000. This code brings me nowhere, and searching for
this event brought me to information about Windows servers (2003 etc)
from more than 10 years ago.
Apart from this, updates shouldn't take place between 9.00 and 22.00.
So - what's going on here?

Fokke

Fokke Nauta wrote:
Hi all,

We have a file server, running W10 Pro 64b.
Yesterday and today afternoon the server went offline and didn't come
back. I had to pull the power cord out and in again and boot it up.
Today I checked the event viewer and saw "Legacy API Shutdown", with the
error code 0x8007000. This code brings me nowhere, and searching for
this event brought me to information about Windows servers (2003 etc)
from more than 10 years ago.
Apart from this, updates shouldn't take place between 9.00 and 22.00.
So - what's going on here?

Fokke

There's another digit in the error code. Example: 0x80070005
Things ending in "5" tend to be permission problems. The error
code could be considered to be a signed 32 bit number (a
negative number), which is represented by 8 hex digits.

Even if a reboot was scheduled for some part of the
day, I don't think the download portion and pre-load
of files need be time restricted. And in some cases,
the pre-load requires shutting down of services
(which strictly speaking, is the wrong way to do it).
The idea was supposed to be, an update should not
disturb anything, because all the "dirty work" is
done during the reboot. But people have seen
bizarre symptoms from activities behind the scenes,
and then the reboot seems to clear them.

One thing you could try, is check the Window Update
history tab, and correlate the latest install (perhaps
the Patch Tuesday one from a week ago), with the
timing of the symptoms you've seen.

When you find the "Legacy API Shutdown" in Eventvwr.msc,
you should also look back immediately in time, and see
if other things were shutting down. Perhaps there was
a resource issue at the time, and the server was
actually being degraded in multiple ways.

Paul

| We have a file server, running W10 Pro 64b.
| Yesterday and today afternoon the server went offline and didn't come
| back. I had to pull the power cord out and in again and boot it up.
| Today I checked the event viewer and saw "Legacy API Shutdown", with the
| error code 0x8007000. This code brings me nowhere, and searching for
| this event brought me to information about Windows servers (2003 etc)
| from more than 10 years ago.
| Apart from this, updates shouldn't take place between 9.00 and 22.00.
| So - what's going on here?
|

Are you sure you're not missing a number there?
Errors are 32-bit integers, generally 8 hex places.
80070000 would mean no problems. Maybe there
was a digit at the end that you missed?

8007 is the category and denotes "win32 or network
error". According to the docs, you can check the
other part, the high word, like so:

net helpmsg x

where x is the last 4 digits of an 8 digit error code.

I don't know what legacy api shutdown means. My
best guess would be that some software made a
direct API call to shut down, which doesn't tell
you much.

I find that usually searching for exact phrases
turns up answers. I got results searching for
"Legacy API Shutdown". And one of them says
they got an error 80070000, which should mean no
error. In other words, it's just saying Windows
shut down due to a request from some process.

Fokke Nauta wrote:

We have a file server, running W10 Pro 64b.
Yesterday and today afternoon the server went offline and didn't come
back. I had to pull the power cord out and in again and boot it up.
Today I checked the event viewer and saw "Legacy API Shutdown", with the
error code 0x8007000. This code brings me nowhere, and searching for
this event brought me to information about Windows servers (2003 etc)
from more than 10 years ago.
Apart from this, updates shouldn't take place between 9.00 and 22.00.
So - what's going on here?

What type of event in Event Viewer? Informational, Warning, or
Critical? What was the event ID?

If just an informational event, it didn't cause the hang. Was there a
comment in the event's log? For example, was there a comment about a
real-time clock event? Some users configure backups or other scheduled
tasks to shutdown the computer when they complete. The software can
only request a shutdown. Some users found their firmware (BIOS) had an
update to fix the problem of performing the programmatic shutdown.

Legacy API shutdown means a process issued a shutdown request using
older API functions to issue the request. I don't do OS or BIOS
programming to know what "legacy" means, like perhaps "legacy" means
different requests types between APM and ACPI. Found some info at:

https://wiki.osdev.org/Shutdown

Usually it is in the events before the shutdown that you need to look at
to see why there was a shutdown. 0x8007000 is a very broad error code,
so it's of usually no value. See what happened before the shutdown was
requested.

The 0x8007000 error code might be an "okay" return status value. The
Win32 process return code (status) gets transformed into an HRESULT: the
return code gets appended to 0x800700. See:

https://msdn.microsoft.com/en-us/library/gg567305.aspx

If the event was informational, the 0x8007000 means a 0 status (no
error) got returned. The shutdown proceeded okay because something
requested it. You might see what it was by looking at the events before
the shutdown event.

Whatever software requested the shutdown is perhaps configured to do
issue a shutdown, so you have to revisit what software you run or
schedule to run to see if it has a "shutdown when completed" option
enabled. The hang itself is probably due to some other software, like a
driver, that crashes or hangs for this type of shutdown or even when
going into low-power mode (OS goes into Standby but driver prevents
coming out of standby, so computer is effectively hung).

How do you know that Windows updates didn't occur between 0900 and 2200?
That's a wide time range per day. I've found when updates fail and do
so repeatedly, I sometimes have to clear the local update catalog. This
forces the WU client to rebuild the local catalog and then the updates
succeed. There are plenty of online articles on "clear delete windows
update catalog".

Have you updated your anti-virus (hopefully you're using something
better than Windows Defender) and scanned for viruses? Have you ever
deleted a virus? Eradicating a virus doesn't repair damages it causes,
like corrupting system files. Run "chkdsk c: /r" (will take a long
time) and then "sfc /scannow".

On 22/08/2018 17:26, VanguardLH wrote:
Fokke Nauta wrote:

We have a file server, running W10 Pro 64b.
Yesterday and today afternoon the server went offline and didn't come
back. I had to pull the power cord out and in again and boot it up.
Today I checked the event viewer and saw "Legacy API Shutdown", with the
error code 0x8007000. This code brings me nowhere, and searching for
this event brought me to information about Windows servers (2003 etc)
from more than 10 years ago.
Apart from this, updates shouldn't take place between 9.00 and 22.00.
So - what's going on here?

What type of event in Event Viewer? Informational, Warning, or
Critical?

Windows logs - System

What was the event ID?

98

If just an informational event, it didn't cause the hang. Was there a
comment in the event's log?

In Details:
EventData

DriveName Install
DeviceName \Device\HarddiskVolumeShadowCopy4
CorruptionActionState 0

For example, was there a comment about a
real-time clock event? Some users configure backups or other scheduled
tasks to shutdown the computer when they complete. The software can
only request a shutdown. Some users found their firmware (BIOS) had an
update to fix the problem of performing the programmatic shutdown.

Didn't do anything with the BIOS.

Legacy API shutdown means a process issued a shutdown request using
older API functions to issue the request. I don't do OS or BIOS
programming to know what "legacy" means, like perhaps "legacy" means
different requests types between APM and ACPI. Found some info at:

https://wiki.osdev.org/Shutdown

Usually it is in the events before the shutdown that you need to look at
to see why there was a shutdown. 0x8007000 is a very broad error code,
so it's of usually no value. See what happened before the shutdown was
requested.

The only thing I can find is:
The process C:\Windows10Upgrade\Windows10UpgraderApp.exe (SERVER) has
initiated the restart of computer SERVER on behalf of user SERVER\Fokke
Nauta for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shut-down Type: restart
Comment: Windows 10 Update Assistant will reboot your device to
complete the update.


One hour befo
EventData

updateTitle GDR-DU: LanguageFeatureOnDemand - Windows 10 April 2018
Update for x64-based Systems - (KB4132443) [en-US]
updateGuid {284C63BB-AD07-461B-9C64-C4F9577B30AC}
updateRevisionNumber 203


The 0x8007000 error code might be an "okay" return status value. The
Win32 process return code (status) gets transformed into an HRESULT: the
return code gets appended to 0x800700. See:

https://msdn.microsoft.com/en-us/library/gg567305.aspx

If the event was informational, the 0x8007000 means a 0 status (no
error) got returned. The shutdown proceeded okay because something
requested it. You might see what it was by looking at the events before
the shutdown event.

Whatever software requested the shutdown is perhaps configured to do
issue a shutdown, so you have to revisit what software you run or
schedule to run to see if it has a "shutdown when completed" option
enabled. The hang itself is probably due to some other software, like a
driver, that crashes or hangs for this type of shutdown or even when
going into low-power mode (OS goes into Standby but driver prevents
coming out of standby, so computer is effectively hung).

How do you know that Windows updates didn't occur between 0900 and 2200?

Because I set in Windows Update the Active Hours from 9.00 to 22.00.
Pretty default, I think.

That's a wide time range per day. I've found when updates fail and do
so repeatedly, I sometimes have to clear the local update catalog. This
forces the WU client to rebuild the local catalog and then the updates
succeed. There are plenty of online articles on "clear delete windows
update catalog".

Have you updated your anti-virus (hopefully you're using something
better than Windows Defender)

What is Windows Defender? Does it still exist? Does it defend anything?
Not on this system. It's disabled by default.

Though a few American's won't like it, I'm running Kaspersky :-) on all
our systems.

and scanned for viruses? Have you ever
deleted a virus?

Scanned: Yes. Found: No. Never found anything. Neither malware.

Eradicating a virus doesn't repair damages it causes,
like corrupting system files. Run "chkdsk c: /r" (will take a long
time) and then "sfc /scannow".


Thanks,
Fokke

On 22/08/2018 16:54, Mayayana wrote:
| We have a file server, running W10 Pro 64b.
| Yesterday and today afternoon the server went offline and didn't come
| back. I had to pull the power cord out and in again and boot it up.
| Today I checked the event viewer and saw "Legacy API Shutdown", with the
| error code 0x8007000. This code brings me nowhere, and searching for
| this event brought me to information about Windows servers (2003 etc)
| from more than 10 years ago.
| Apart from this, updates shouldn't take place between 9.00 and 22.00.
| So - what's going on here?
|

Are you sure you're not missing a number there?

No!

Errors are 32-bit integers, generally 8 hex places.
80070000 would mean no problems. Maybe there
was a digit at the end that you missed?

8007 is the category and denotes "win32 or network
error". According to the docs, you can check the
other part, the high word, like so:

net helpmsg x

net helpmsg 8007000
8007000 is not a valid Windows network messsage number.
More help is available by typing NET HELPMSG 3871.

net helpmsg 7000
The system cannot find message text for message number 0x1b85 in the
message file for NETMSG.

where x is the last 4 digits of an 8 digit error code.

I don't know what legacy api shutdown means.

Neither do I

My
best guess would be that some software made a
direct API call to shut down, which doesn't tell
you much.

I find that usually searching for exact phrases
turns up answers. I got results searching for
"Legacy API Shutdown". And one of them says
they got an error 80070000, which should mean no
error. In other words, it's just saying Windows
shut down due to a request from some process.

On 22/08/2018 16:49, Paul wrote:
Fokke Nauta wrote:
Hi all,

We have a file server, running W10 Pro 64b.
Yesterday and today afternoon the server went offline and didn't come
back. I had to pull the power cord out and in again and boot it up.
Today I checked the event viewer and saw "Legacy API Shutdown", with
the error code 0x8007000. This code brings me nowhere, and searching
for this event brought me to information about Windows servers (2003
etc) from more than 10 years ago.
Apart from this, updates shouldn't take place between 9.00 and 22.00.
So - what's going on here?

Fokke

There's another digit in the error code. Example: 0x80070005
Things ending in "5" tend to be permission problems. The error
code could be considered to be a signed 32 bit number (a
negative number), which is represented by 8 hex digits.

Even if a reboot was scheduled for some part of the
day, I don't think the download portion and pre-load
of files need be time restricted. And in some cases,
the pre-load requires shutting down of services
(which strictly speaking, is the wrong way to do it).
The idea was supposed to be, an update should not
disturb anything, because all the "dirty work" is
done during the reboot. But people have seen
bizarre symptoms from activities behind the scenes,
and then the reboot seems to clear them.

One thing you could try, is check the Window Update
history tab, and correlate the latest install (perhaps
the Patch Tuesday one from a week ago), with the
timing of the symptoms you've seen.

When you find the "Legacy API Shutdown" in Eventvwr.msc,
you should also look back immediately in time, and see
if other things were shutting down. Perhaps there was
a resource issue at the time, and the server was
actually being degraded in multiple ways.

Paul

Hmmmmm

Perhaps I should use a Linux server?
A bit dissapointed in a Windows system ...

Fokke

"Fokke Nauta" wrote

| net helpmsg 8007000
| 8007000 is not a valid Windows network messsage number.
| More help is available by typing NET HELPMSG 3871.
|
| net helpmsg 7000
| The system cannot find message text for message number 0x1b85 in the
| message file for NETMSG.
|
You're missing a number. You have to be.
The last 4 are the error code but that's with
an 8 digit code. In any case, it seems likely
that there was no error. (80070000)
Just something you haven't yet found that
had a reason to call for a shutdown.

I wonder if there might be a clue in the event(s)
just prior. But I'm not an expert on that. I use
event viewer so seldomly that I always have
to figure out where it is when I do.

Fokke Nauta wrote:

The only thing I can find is:
The process C:\Windows10Upgrade\Windows10UpgraderApp.exe (SERVER) has
initiated the restart of computer SERVER on behalf of user SERVER\Fokke
Nauta for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shut-down Type: restart
Comment: Windows 10 Update Assistant will reboot your device to complete the update.

One hour befo
EventData

updateTitle GDR-DU: LanguageFeatureOnDemand - Windows 10 April 2018
Update for x64-based Systems - (KB4132443) [en-US]
updateGuid {284C63BB-AD07-461B-9C64-C4F9577B30AC}
updateRevisionNumber 203


https://www.reddit.com/r/sysadmin/co...ndows_10_1803/

"Having looked in WSUS there is an update named:

GDR_DU: FeatureOnDemandXpsViewer -

Windows 10 April 2018 Update for x64-based systems (KB4132443)
"

So installing XPSViewer (a thing like PDF only Microsoft proprietary)
caused the server to reboot ? Classic goodness.

And this ( "C:\Windows10Upgrade\Windows10UpgraderApp.exe" )
looks for all the world like you just got 17134 OS installation.

The Windows Update install history is likely pretty empty now,
as a version change would start the history afresh.

The "0x80070000" is a normal "Please Shutdown" request.
Your server was not abnormally terminated - some software
decided to reboot it.

Paul

On 22/08/2018 20:06, Paul wrote:
Fokke Nauta wrote:

The only thing I can find is:
The process C:\Windows10Upgrade\Windows10UpgraderApp.exe (SERVER) has
initiated the restart of computer SERVER on behalf of user
SERVER\Fokke Nauta for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shut-down Type: restart
Comment: Windows 10 Update Assistant will reboot your device to
complete the update.

One hour befo
EventData

updateTitle GDR-DU: LanguageFeatureOnDemand - Windows 10 April 2018
Update for x64-based Systems - (KB4132443) [en-US]
updateGuid {284C63BB-AD07-461B-9C64-C4F9577B30AC}
updateRevisionNumber 203


https://www.reddit.com/r/sysadmin/co...ndows_10_1803/


"Having looked in WSUS there is an update named:

GDR_DU: FeatureOnDemandXpsViewer -

Windows 10 April 2018 Update for x64-based systems (KB4132443)
"

So installing XPSViewer (a thing like PDF only Microsoft proprietary)
caused the server to reboot ? Classic goodness.

And this ( "C:\Windows10Upgrade\Windows10UpgraderApp.exe" )
looks for all the world like you just got 17134 OS installation.

The Windows Update install history is likely pretty empty now,
as a version change would start the history afresh.

The "0x80070000" is a normal "Please Shutdown" request.
Your server was not abnormally terminated - some software
decided to reboot it.

Paul

OK, but it did not restart. It just hung.
Well, Windows... I thought 10 would be OK.

Considering Linux ...

Fokke

Fokke Nauta wrote:

OK, but it did not restart. It just hung.
Well, Windows... I thought 10 would be OK.

Considering Linux ...

Fokke

I'm recommending you review, in your mind, what
was done in the 24 hours leading up to the event.
*Someone* was playing with icons on the desktop
of that server. This event sequence didn't initiate
all on its own. A "human" helped. That's what your
event log is telling me.

Were you "futzing" with the server, playing
with the controls ? Did you double click
Windows10UpgraderApp.exe ? It's an icon Microsoft
left on your desktop, on one of the releases.
If someone clicks that icon, the OS will then
check for any pending OS Upgrades (16299 to 17134).
That's like a "loose cannon", in that a visitor
to your server area, could click that for fun
if they wanted.

On a "server role", normally you do *not* load
desktop components. Since you were using a desktop
OS as a server, that subsystem was already present.
(On servers, there's an option to install a desktop
support package.) Microsoft OSes have a limit on
the number of connections a desktop OS will support,
making them sufficient as a SOHO server, but not
enough for anything bigger.

On Linux, you can have a server role, and can have
it for free. It gives you an OS installation without
a GUI, and with just a 24x80 "Command Prompt" window
to do all of your operations. If you choose to install
a DE on top of it (because you're "not a real IT guy"),
then in effect you've made a desktop OS out of it again.

Servers are stripped down, to keep them simple, and
prevent complicated situations from arising.

Linux still has auto-update capability, and there will
be times when you cannot get into the package manager,
because Software Updates is running in the background.
This is different than Windows, where you can "race"
the OS on a Windows Update - you can download the
update from catalog.update.microsoft.com and double-click
to install, and if yours finished first, the one that
Windows Update is trying to do will be suspended.
Linux doesn't work quite the same way.

Normally, maintenance intervals on servers are restricted
to hours where the maintenance will not affect anyone. If the
server needed an upgrade, you might move the storage over
to a second box, while the first box is upgraded. Then
move the stuff back later. In some cases, people do all
of this via virtualization.

Paul

Fokke Nauta wrote:

VanguardLH wrote:

Fokke Nauta wrote:

We have a file server, running W10 Pro 64b.
Yesterday and today afternoon the server went offline and didn't come
back. I had to pull the power cord out and in again and boot it up.
Today I checked the event viewer and saw "Legacy API Shutdown", with the
error code 0x8007000. This code brings me nowhere, and searching for
this event brought me to information about Windows servers (2003 etc)
from more than 10 years ago.
Apart from this, updates shouldn't take place between 9.00 and 22.00.
So - what's going on here?

What type of event in Event Viewer? Informational, Warning, or
Critical?

Windows logs - System

That's the category (into which events get grouped). Applications can
even add their own category (so events get recorded under that group).
In the event list itself, there is a column that says what TYPE of event
it was and to which I gave a clue: Information, Warning, or Critical.

My guess is the shutdown was required, got performed (started), so it is
just an Information[al] event. The event type is one of the columns in
the same list of events where you got the following event ID.

What was the event ID?

98

http://www.eventid.net/

You can enter an event ID number for lookup. Of those found for 98:

CertSvc - Doesn't seem this would be the source of the hung shutdown.
NTFS - Could be [system] file corruption and why I mentioned doing a
chkdsk (with the /r switch) and perhaps sfc /scannow, too.
RSM - Perhaps but that would seem something a backup program might
do to unmount a volume. I recall reading a forum post where a
user reported they had a problem with Volume Shadow Copy which
also seems related to backups (backup programs, system
restore, etc) which may use VSC or even their own shadow-type
procedure to capture inuse files. RSM stopping is usually
just an Information event. Even NTbackup will stop the RSM
service. As I recall, RSM is a service that gets started when
requested by a caller (a process needs RSM). The caller could
stop RSM when done or leave it dangling (like the caller
crashed or aborted) which means RSM stops around 30 minutes
after its last use.
SNA - Are you telnetting somewhere (tn3270 emulator) or using an SNA
server?
WMIxWDM - I would think the comment in the event would indicate if this
was the problem source.

When you look back at eventvwr.msc to see the record for the shutdown
event, what source was listed for that event?

Select the event in Event Viewer. Right-click on it. Select Copy -
Details as Text. Then paste in your reply.

In Details:
EventData

DriveName Install
DeviceName \Device\HarddiskVolumeShadowCopy4
CorruptionActionState 0

Looking more like a backup problem. To get at inuse files, VSC is used
to create a shadow copy of files to put those into a backup.

The only thing I can find is:
The process C:\Windows10Upgrade\Windows10UpgraderApp.exe (SERVER) has
initiated the restart of computer SERVER on behalf of user SERVER\Fokke
Nauta for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shut-down Type: restart
Comment: Windows 10 Update Assistant will reboot your device to
complete the update.

You claimed there were no Windows updates during the time of the event.
Well, you actually said no WU from 0900 to 2200. Does the Windows
Update history confirm there were no updates during that time? How
about sooner? Maybe an update occured off-hours but was pending a power
cycle (shutdown and then startup).

Seems the shutdown event was just informational. As to why the computer
hung, that's either because some updates take damn long to complete, a
driver won't disengage, or some running software prevents the shutdown.
I've seen Windows updates that tell me they are working when I shutdown
the computer myself. In older Windows, I had WU set to "never check"
which also means to never download to cache locally. Yet occasionally I
would see a WU message when shutting down tell me to wait. It could be
over an hour before the shutdown completed. Then, on startup, I'd get
another message saying there was more updating and I'd have to wait
another long interval. I'd have to sometimes give up using my computer
for an hour, or two, just to let the updates complete - that I did not
want! These covert updates occur no matter how you set the WU client in
any version of Windows, often to update the WU client itself. To avoid
the covert updates, and because Microsoft wouldn't honor the "never
check" setting, I disable both the WU (Windows Updates) and BITS
(Background Intelligent Transfer Service) services. Cover updates with
"never check" has been a prolonged problem with Windows. Kill the
services (stop and disable them) to make sure Microsoft doesn't sneak
something in.

One hour befo
EventData

updateTitle GDR-DU: LanguageFeatureOnDemand - Windows 10 April 2018
Update for x64-based Systems - (KB4132443) [en-US]
updateGuid {284C63BB-AD07-461B-9C64-C4F9577B30AC}
updateRevisionNumber 203

So there was an update an hour before. Even when an update doesn't
mandate a reboot, I do it anyway. I've seen pending file changes cause
problems until they get replaced after a rebooting (the PendingRename
registry key is not empty until after a reboot). Have a mixture of
files can result in problems expecting behavior in a method that has
changed.

How do you know that Windows updates didn't occur between 0900 and 2200?

Because I set in Windows Update the Active Hours from 9.00 to 22.00.
Pretty default, I think.

Was the update event you noted above during active hours configured in
the WU client? If the update occurred outside active hours as
configured, did you run any software that upon its completion will
reboot Windows?

While you have active hours configured locally, and because you mention
this was a server edition, did you make sure a policy wasn't getting
pushed (after you login and connect to the domain) to change the WU
active hours config? You can set your local policy but domain policies
get pushed that will override the local settings. All policies are
registry entries, and those can get overwritten by pushed domain
policies or by batch or .reg files used on Windows startup or login (via
login script, startup registry entries, Startup folder, etc).

https://docs.microsoft.com/en-us/win...e/waas-restart

Did you check your server host's time and date? Since active hours
specify a range, that triggers based on the OS clock (not the BIOS or
RTC clock). Make sure Windows has the correct time, even after power
off, power on, and boot.

I haven't checked if there is a reported bug with active hours
configured for the WU client. I mentioned the wrong OS clock as a
possibility why the updates happened when the wall clock indicated a
time during a range that you expected to be active hours.

I don't use active hours. There are no inactive hours on my computer.
I might be using it at ANY time of the day: morning, afternoon, evening,
wee morning hours ... ANYTIME. As I recall, Microsoft extended the
range from 12 to 18 hours for the active hours range. There is no 18
hour range during a 24-hour day where I will never or even occasionally
be using my computer during the other 6 hours.

The only way I found to control when updates are allowed is by disabling
the BITS and WU services. I have a .bat file to enable and start both
the BITS and WU services (for after I prepare, like save a backup image,
and allow and check for updates to apply any) and another .bat file to
stop and disable the BITS and WU services (like after updates have been
applied and I want to prevent any interrupting or covert updates). At
the end of the batch files is a pause so the console window remains
loaded and I can check the status returned by the Service Controller
(sc.exe) command-line program. Hit a key and the window closes. Both
batch files use the sc.exe program to stop/start and disable/enable
services. I guess I could run the batch files with admin privileges in
Task Scheduler: one scheduled event to run WU-enable.bat during
non-active hours (or not bother defining active hours so all hours are
candidate update times), and another scheduled event to run
WU-disable.bat during active times. However, scheduling won't work for
me because I might be using my computer at ANY time. There are no
non-active hours.

I just have 3 shortcuts in a "Windows Update" folder in my Start menu
that contains shortcuts named "1 - Enable WU", "2 - WU check", and "3 -
Disable WU" (the numerical prefix is just so they sort in that order in
the folder to make sure I run them in that order). I decide when
updates get applied by when I enable and start the services that the WU
client uses, and after applying any updates then I disable those
services to keep Microsoft away from my computer until *I* am ready.

Fokke Nauta wrote:

OK, but it did not restart. It just hung.
Well, Windows... I thought 10 would be OK.

How long did you wait after the shutdown event? A noted in my prior 2nd
reply, some updates seem to take a very long time, like over an hour to
allow the shutdown and then a long time upon the subsequent boot to
finish the updating.

Mayayana wrote:

"Fokke Nauta" wrote

| net helpmsg 8007000
| 8007000 is not a valid Windows network messsage number.
| More help is available by typing NET HELPMSG 3871.
|
| net helpmsg 7000
| The system cannot find message text for message number 0x1b85 in the
| message file for NETMSG.
|
You're missing a number. You have to be.
The last 4 are the error code but that's with
an 8 digit code. In any case, it seems likely
that there was no error. (80070000)
Just something you haven't yet found that
had a reason to call for a shutdown.

I wonder if there might be a clue in the event(s)
just prior. But I'm not an expert on that. I use
event viewer so seldomly that I always have
to figure out where it is when I do.

See my reply where HRESULT is mentioned. 0x8007000 is a prefix upon
which the return status of the program gets appended. However, that
appended status isn't shown, so the user only see the incomplete error
code prefix string. Without the return status from the program added to
the generic error string, the list of causes is vast as the generic
string really doesn't point at anything particular.

"VanguardLH" wrote

| See my reply where HRESULT is mentioned. 0x8007000 is a prefix upon
| which the return status of the program gets appended. However, that
| appended status isn't shown, so the user only see the incomplete error
| code prefix string. Without the return status from the program added to
| the generic error string, the list of causes is vast as the generic
| string really doesn't point at anything particular.

https://blogs.technet.microsoft.com/...more-friendly/