Restart Frequency in Endpoint Analytics

Share This Post

Restart Frequency is a recent addition to Endpoint Analytics and provides insight to when devices are being rebooted and why. As mentioned in the introduction post, the objective is for operational and helpdesk departments be more proactive and provide insights on end-user devices. This post is an extension to the four part series on Endpoint Analytics, where we will look at some of the new features released by Microsoft.


Related Posts:

Restart Metrics

Endpoint Analytics can be accessed from the Endpoint Manager Admin Center under Reports. In the Endpoint Analytics blade select Startup Performance and the Restart Frequency tab should be to the far right.

In the initial release (public preview) of Restart Frequency there are six different metric groups. If a reboot or shutdown does not go through the normal Windows procedure it is considered an abnormal restart. If there is an abnormal restart that is not caused by either a blue screen or a long power-button press the unknown category is used. The three remaining categories (Update, Restart, and Shutdown) are considered normal restarts.

  • Blue screens – If a device experiences a blue screen / stop error event.
  • Long power-button press – If a user holds down the power button, for example resolve a non-responsive system.
  • Update – A restart was required to complete a feature or security update.
  • Restart (no update) – Any restart that is not required due to a system update or feature update. Microsoft insists that these values should be close to zero as they dont see any other reason for reboots other than monthly patching. Personally i dont agree with this vision as there could be other valid reasons to restart the system.
  • Shutdown (no update) – User issuing a controlled system shutdown from Windows.
  • Unknown – Any abnormal restart that is not covered by any other metric group.

Note that the Restart Frequency tab displays information for the last 30 days according to the UI., however the documentation says only 14 days. Microsoft might be updating this threshold and might not have updated the documentation yet.

Restart Frequency metrics

Device Performance

In the Device Performance tab there are now two new columns that indicate the amount of reboots and the amounts of blue screens per system in the last 14 days. This is useful information for operations and helpdesk to find devices that are having problems.

Device Performance

Device Specifics

If we select a specific device we can get additional device specific information on restart. If there is a blue screen we can get the stop code without having to contact the user directly. The Failure Bicker ID can be provided to Microsoft Support to troubleshoot issues.

Device Specifics

Model Performance

In the Device Performance tab there are also two additional columns that display average reboots and blue screens for a particular device model. Note that at least 10 devices of the same model is required in order for information to be displayed. The Average Blue Screen column would give a good indication if there was a particular device model in the organization with a bad driver or configuration that is causing blue screens.

Model Performance

Want To See More?

Azure AD

Access Reviews with On-Premise Groups

In some of my earlier post I have talked about Access Reviews that are part of the Identity Governance tools in Azure AD. One of


Access Reviews: Manage Guest Users

Azure AD’s B2B (Business to Business) functionality allows organizations to invite external users into their organization so that they can collaborate. However, very few of