This is what we see in the upgrade log file located in c:$WINDOWS.~BT\Sources\Rollback\evtlogs\system.evtx.
The process C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe (XXXXXXXX) has initiated the restart of computer XXXXXXXX on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned)
Reason Code: 0x80000000
Shutdown Type: restart
Comment: IBM BigFix Restart from ActionID 391940
There is a post for this problem where the restart was taking too long with a possible workaround, but to me it is a bug. If the user selects Take Action on a restart it should happen right away not 30 minutes latter.
Ihttps://forum.bigfix.com/t/restart-now-is-more-like-probably-restart-in-10-20-minutes/9185
I am not seeing how to attach a log file.