by Martin Brinkmann on July 20, 2018 in Windows - Last Update: July 20, 2018 - 14 comments
To continue, you must first add this website to your trusted sites in Internet Explorer. The site cannot determine which updates apply to your computer or display those updates unless you change your security settings to allow ActiveX controls and active scripting. T735642 suggests that in some conditions a system restart might fix the problem while ME906602 provides information on how to troubleshoot common Windows Update, Microsoft Update, and Windows Server Update Services installation issues.
The updates KB4345418 and KB4054566 which Microsoft released on July 16, 2018 seem to cause issues such as high CPU load or RDS connection issues on Windows Server 2012 R2 and Windows Server 2016 in some scenarios.
![Windows update agent event id 20 Windows update agent event id 20](/uploads/1/2/4/8/124891940/641061977.png)
Microsoft released several updates on July 16, 2018 designed to resolve issues that were introduced by updates released on the July 2018 Patch Tuesday.
The updates fixed issues such as connectivity loss scenarios, stop error 0xD1 when running network monitoring workloads, issues that caused the restart of SQL servers to fail, or issues when trying to stop the World Wide Web Publishing Service.
The updates, KB4345418 for Windows 10 version 1607 and Windows Server 2016, and KB4054566, the Microsoft .NET Framework 4.7.2 for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2, were designed to address the issues described. It appears that the updates may introduce issues of their own on systems they are installed on.
Server administrators started to report issues that they identified after installation of the updates shortly after release.
One issue was that Microsoft Azure Active Directory Connect (AADConnect) stopped working after installation of the updates on Server 2016 and 2012 R2 machines.
A user on the Ask Woody forum described the issue in the following way:
Even with the updated patch on Server 2016 (KB4345418) is still causing an issue with AADConnect servers that triggers a 100% CPU spike on some of the Health and Reporting monitoring services, only fix at this point is to uninstall the latest update. It seems to impact at least 2012 and 2016 servers. …
A forum thread on the Microsoft Developer Network forum confirms the issue. One user reported that uninstallation of KB4054566 resolved the issue in a Windows Server 2012 R2 environment.
Restarting the services brings CPU usage back to normal, and the only option right now to resolve it appears to be to uninstall the latest updates.
But issues with AADConnect were not the only ones that administrators reported after release of the patches.
Matt Wilkinson reported on Twitter that KB4345418 was causing black screen upon login issues when using Remote Desktop Services on Server 2016.
KB 4345418 is causing issues on Server 2016 RDS with a black screen upon login. Have mitigated this issue with a script to delete firewall rules that are created per user. Black screen returned with this update.
Closing Words
The July 2018 updates caused a lot of issues for users up until now. Clothing design software. It is not the first time that updates that Microsoft releases cause issues on systems they are installed on.
I think it is fair to say that users need to understand that any patch that Microsoft releases can have unforeseen consequences; some will even wreak the system. The creation of backups is advised.
Now You: Did you run into issues after installing patches recently? (via Born)
KB4345418 and KB4054566 causing high CPU load
Description
The updates KB4345418 and KB4054566 which Microsoft released on July 16, 2018 seem to cause issues such as high CPU load or RDS connection issues on Windows Server 2012 R2 and Windows Server 2016 in some scenarios.
Author
Ghacks Technology News
Logo
AdvertisementActive1 month ago
How can I easily see a history of every time my Windows Server has restarted or shutdown and the reason why, including user-initiated, system-initiated, and system crashed?
The Windows Event Log is an obvious answer but what is the complete list of events that I should view?
I found these posts that partially answer my question:
- Windows server last reboot time includes several answers that partially address the full restart history
- View Shutdown Event Tracker logs under Windows Server 2008 R2 includes an additional event id
- Event Log time when Computer Start up / boot up includes some of the same event ids
but those don't cover every scenario AFAIK and the info is hard to understand because it is spread across multiple answers.
I have several versions of Windows Server so a solution that works for at least versions 2008, 2008 R2, 2012, and 2012 R2 would be ideal.
Community♦
JohnCJohnC1,56411 gold badge99 silver badges1515 bronze badges
4 Answers
The clearest most succinct answer I could find is:
which lists these event ids to monitor (quoted but edited and reformatted from article):
- Event ID 6005 (alternate): “The event log service was started.” This is synonymous to system startup.
- Event ID 6006 (alternate): “The event log service was stopped.” This is synonymous to system shutdown.
- Event ID 6008 (alternate): 'The previous system shutdown was unexpected.' Records that the system started after it was not shut down properly.
- Event ID 6009 (alternate): Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.
- Event ID 6013: Displays the uptime of the computer. There is no TechNet page for this id.
Add to that a couple more from the Server Fault answers listed in my OP:
- Event ID 1074 (alternate): 'The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z.' Indicates that an application or a user initiated a restart or shutdown.
- Event ID 1076 (alternate): 'The reason supplied by user X for the last unexpected shutdown of this computer is: Y.' Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.
Did I miss any?
JohnCJohnC1,56411 gold badge99 silver badges1515 bronze badges
I would simply leave this as a comment since JohnC has basically covered everything, but I am not allowed to do so yet.
The events he described have been used for quite a while, so they will work for any of the OS you mentioned, as well as their desktop brethren. The event ID pages He linked to, such as the one for 6006 on TechNet, mention Windows Server 2003.
If there was an elegant shutdown, user initiated or otherwise, you should also see some Event ID 7036 telling you that various services 'entered the stopped state.' As the machine starts up again, you will see more 7036s announcing that services are entering the running state.
JTLJTL
Building on @JohnC s answer and extending it
You could use an XML filter like:
You can replace 172800000 with the below values for the time range:
86400000 - Last 24 hours
172800000 - Last 2 Days
Linux x windows configuration. Regular users do not have permissionsto make system changes.
604800000 - Last 7 Days
This will show much more detail from the time when the server/pc went offlineIt includes Kernel-Power, User32 and EventLog events.
elemer82elemer82
I prefer to accomplish activities from command line. Free pc diagnostic software download. Here's the beginning of a snippet you can leverage. This shows the most recent 30,000 system records and returns the reboots within those records.
Windows Event Id 2004
RakaimRakaim