Pending Restart Issue

I deployed a patch and the endpoint goes to ‘pending restart’ status. So I performed a reboot of that server.
But the BESPendingRestart value in registry is not getting removed at all.

Tried multiple times rebooting the endpoint manually and through restart fixlet and the issue still exists.
Because of the pending restart status, other dependent activities are in waiting state.

Has any one experienced it before? Please share your inputs.

Presuming that this is Windows, check the locations mentioned in 9.5.2 problem with detecting restart? for the locations where the client gets the restart information from.

2 Likes

Excerpted from that thread: If ANYTHING is pending a restart, NONE of the pending restart actions will update their status

1 Like

Correct as the agent doesn’t know which of the “Windows” restart indications belonged to a BigFix action

@AlanM @JasonWalker

So how do I overcome this situation?

The thread @AlanM referenced included some Registry paths to check to see what’s flagging the Pending Restart. There have been some instances where applications (some drivers in particular) always set values in these keys where they should not. If that’s the case, there are some exceptions you can add to the BES client so that a particular value in one of those keys can be ignored.

@JasonWalker

Key: HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESPendingRestart

values: BES Pending Restart; xxx_unistall1; xxx_uninstall2

This is where is see 3 unique values for BES pending restart.
Does it mean, do i have to reboot the machine 3 times to get rid of this key?

Do you see anything in these other keys?
HKLM\System\CurrentControlSet\Control\Session Manager value: PendingFileRenameOperations
HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
HKLM\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending
HKLM\Software\Microsoft\Updates value: UpdateExeVolatile

The key you referenced for BESPendingRestart are the values put there though an “action requires restart” or “action may require restart” command in a Fixlet. These three values should all be cleared after a single reboot - if the BES Client detects that there are no other pending restarts. If one of those four keys/values above still has data, the BES Client detects a restart is still needed and does not clear the BESPendingRestart key.

1 Like

I see this key, how do I proceed further?

The PendingFileRenameOperations value is a REG_MULTI_SZ type. There should be multiple “lines” to this value when you read it in regedit. The lines are in pairs - where the first line in each pair is the source file, and the second line of each pair is the destination file. An empty second line implies a Delete rather than a Move. As an example, right now my workstation has these values:

\??\C:\windows\system32\spool\PRTPROCS\x64\2_GNUD054C.DLL

\??\C:\windows\system32\SET54BA.tmp
!\??\C:\windows\system32\difxapi.dll
\??\C:\windows\system32\spool\PRTPROCS\x64\2_hpcpp107.dll

\??\C:\windows\system32\spool\DRIVERS\x64\3\New\hpcpu107.CFG
\??\C:\windows\system32\spool\DRIVERS\x64\3\hpcpu107.CFG

In this case, “C:\windows\system32\spool\PRTPROCS\x64\2_GNUD054C.DLL” is set to be deleted on the next reboot, “C:\windows\system32\SET54BA.tmp” is going to be moved to “C:\windows\system32\difxapi.dll”, “C:\windows\system32\spool\PRTPROCS\x64\2_hpcpp107.dll” is going to be deleted, and “C:\windows\system32\spool\DRIVERS\x64\3\New\hpcpu107.CFG” is going to be moved to “C:\windows\system32\spool\DRIVERS\x64\3\hpcpu107.CFG”. These files are all related to a printer, so it looks like I’ve loaded a new print driver since I last rebooted, and some printer driver moves are going to occur on the next boot.

What you’ll need to do depends on the values in this key. One possibility is that you just need another reboot to make the file moves occur, this registry path will get cleared, BigFix will detect there are no more Pending Reboots, and your action statuses will update. Probably not likely, since that hasn’t happened yet.

There are several known software packages that incorrectly use PendingFileRenameOperations as a counter or self-repair of sorts, adding values every time the system reboots. If you find that you have some software behaving that way, the best answer is to contact the vendor to have them stop using this value incorrectly. That’s probably not very practical, so BigFix provides a way to ignore particular strings in the PendingFileRenameOperations value. See http://www-01.ibm.com/support/docview.wss?uid=swg21506002 for an explanation of how to use the _BESClient_ActionManager_PendingRestartExclusions client setting.

3 Likes

@JasonWalker

That clarifies all my queries and Thank you so much for taking your time to explain me in a detailed fashion.

one last question,

??\C:\windows\system32\spool\PRTPROCS\x64\2_GNUD054C.DLL

??\C:\windows\system32\SET54BA.tmp
!??\C:\windows\system32\difxapi.dll
??\C:\windows\system32\spool\PRTPROCS\x64\2_hpcpp107.dll

??\C:\windows\system32\spool\DRIVERS\x64\3\New\hpcpu107.CFG
??\C:\windows\system32\spool\DRIVERS\x64\3\hpcpu107.CFG

All the above action will happen on a single reboot or it requires a reboot / action?
Thanks again

They should all occur on a single reboot. What does your value for PendingFileRenameOperations look like?

I didn’t make a note of it. But as you said, after a reboot It’s all gone now.

Thank you @JasonWalker

And did your Action Statuses update?

yeah that’s correct :slight_smile: Now I see the status as Completed.

There are some installs which do MORE work when the system reboots and flag the system for YET ANOTHER restart so be aware its not always resolved with one restart.

2 Likes

I agree! Noticed it and also have a analyses in place to report for any change in the registry values you mentioned.

I’m noticing something strange on some servers.

??\C:\WINDOWS\TEMP\vmware-SYSTEM\VMwareToolsUpgrader.exe

This does not disappear from PendingFIleRenameOperations.
I manually tried deleting it and gave a reboot. But it does not disappear and the BESPendingRestart also stays.
How do I overcome this situation? Please help.

Thanks in advance

There is a setting that can eliminate things that keep coming back even with multiple reboots (and note you should only use it if multiple reboots won’t clear things.

 _BESClient_ActionManager_PendingRestartExclusions

Type: String
Version: 7.0
Platform: Windows
Default:
Requires Client Restart: NO
Description: when determining if a restart is needed by examining the windows restart pending list, all items in this ';' delimited list + hpqwmi.events are ignored
1 Like