Restart Frequency is a recent addition to Endpoint Analytics and provides insight to when devices are being rebooted and why. As mentioned in the introduction post, the objective is for operational and helpdesk departments be more proactive and provide insights on end-user devices. This post is an extension to the four part series on Endpoint Analytics, where we will look at some of the new features released by Microsoft.
Contents
Related Posts:
- Part 1 – Getting Started with Endpoint Analytics
- Part 2 – Startup Performance
- Part 3 – Proactive Remediation’s
- Part 4 – Recommended Software
- Part 5 – Restart Frequency (this post)
Restart Metrics
Endpoint Analytics can be accessed from the Endpoint Manager Admin Center under Reports. In the Endpoint Analytics blade select Startup Performance and the Restart Frequency tab should be to the far right.
In the initial release (public preview) of Restart Frequency there are six different metric groups. If a reboot or shutdown does not go through the normal Windows procedure it is considered an abnormal restart. If there is an abnormal restart that is not caused by either a blue screen or a long power-button press the unknown category is used. The three remaining categories (Update, Restart, and Shutdown) are considered normal restarts.
- Blue screens – If a device experiences a blue screen / stop error event.
- Long power-button press – If a user holds down the power button, for example resolve a non-responsive system.
- Update – A restart was required to complete a feature or security update.
- Restart (no update) – Any restart that is not required due to a system update or feature update. Microsoft insists that these values should be close to zero as they dont see any other reason for reboots other than monthly patching. Personally i dont agree with this vision as there could be other valid reasons to restart the system.
- Shutdown (no update) – User issuing a controlled system shutdown from Windows.
- Unknown – Any abnormal restart that is not covered by any other metric group.
Note that the Restart Frequency tab displays information for the last 30 days according to the UI., however the documentation says only 14 days. Microsoft might be updating this threshold and might not have updated the documentation yet.
Device Performance
In the Device Performance tab there are now two new columns that indicate the amount of reboots and the amounts of blue screens per system in the last 14 days. This is useful information for operations and helpdesk to find devices that are having problems.
Device Specifics
If we select a specific device we can get additional device specific information on restart. If there is a blue screen we can get the stop code without having to contact the user directly. The Failure Bicker ID can be provided to Microsoft Support to troubleshoot issues.
Model Performance
In the Device Performance tab there are also two additional columns that display average reboots and blue screens for a particular device model. Note that at least 10 devices of the same model is required in order for information to be displayed. The Average Blue Screen column would give a good indication if there was a particular device model in the organization with a bad driver or configuration that is causing blue screens.
- Part 1 – Getting Started with Endpoint Analytics
- Part 2 – Startup Performance
- Part 3 – Proactive Remediation’s
- Part 4 – Recommended Software
- Part 5 – Restart Frequency (this post)
