Pending restart issue - PendingFileRenameOperations

Content Authoring
1

Hello, most of my servers are going into a pending restart ALL the time. This is due to the fact that the key
HKLM\System\CurrentControlSet\Control\Session Manager
Value PendingFileRenameOperations

has a value on it. Now I do understand that this is happening for external reasons (very annoying but I am not sure I can do anything to it.)

Question here is, is there any instance where a proper/valid windows update will populate that Key? has anyone seen it? my line of thinking is to remove the key from my relevance, hence the pending restart will only be actually given by a windows update and not another application.

2

Historically, many updates do populate the key, but it’s been a while since Ispecifically checked.
Should be trivial to write an Analysis to retrieve the values, and watch what happens after installing an update and before rebooting.

3

thank you Jason, I understand, In my case the pending restart bit is part of an action/automation that reads if updates are applied and server belongs to a specific group and date/time is x/y and pending restart is true, then reboot the server no questions ask.
as we are finding that the “pending restart” relevance is 95% of the time true due to the session manager entry, I am trying to figure another “property” for pending restart…so far it seems the following works…
if(name of operating system starts with “Win”) then((exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix\EnterpriseClient\BESPendingRestart” of it AND exists value “BESPendingRestart” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix\EnterpriseClient\BESPendingRestart” of it) of registry OR (exists key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce” of it AND exists value “BESPendingRestart” of key “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce” of it) of registry) else (false)

but still not sure if that covers any eventuality of windows update to change the value in the session manager (I have not seen that yet)

Thanks

4

Have you looked into the client setting to exclude items so they don’t trigger the Pending Restart as far as BigFix is concerned?

_BESClient_ActionManager_PendingRestartExclusions

String(s) residing in the registry key X which are to be ignored by the BigFix Client when determining if a restart is needed.
The strings must be separated by semicolons and the last string must have a terminating semicolon (for example “exclude1;exclude2;exclude3;”).

With the setting _BESClient_ActionManager_PendingRestartExclusions=:; all entries in the Microsoft registry key HKLM\System\CurrentControlSet\Control\Session ManagerPendingFileRenameOperations are ignored because every entry is a path containing always a colon.

Note: The strings are case sensitive.

5

Hello Tim, yes I looked into that and I tried, but according to the documentation in order to remove the pending restart and get the new exception to read correctly, one must reboot the server.

Rebooting a server here requires a massive amount of paper work, hence I haven’t put that solution in place, but hopefully I will be able to do so in the future.

Thanks.

6

This may sound silly, but have you tried simply restarting the BES Client after creating the setting?

BTW: I feel your pain. I work in Healthcare IT, and we adopted ITIL standards a couple years back. Some days it feels like I have to submit a Request in order to be allowed to submit a Change Request, oh, wait, I DO have to request permission to submit a Change Request!

1 Like