Restart Frequency in Endpoint Analytics

Share This Post

Share on facebook
Share on linkedin
Share on twitter
Share on email

Restart Frequency is a recent addition to Endpoint Analytics and provides insight to when devices are being rebooted and why. As mentioned in the introduction post, the objective is for operational and helpdesk departments be more proactive and provide insights on end-user devices. This post is an extension to the four part series on Endpoint Analytics, where we will look at some of the new features released by Microsoft.

Contents

Related Posts:

Restart Metrics

Endpoint Analytics can be accessed from the Endpoint Manager Admin Center under Reports. In the Endpoint Analytics blade select Startup Performance and the Restart Frequency tab should be to the far right.

In the initial release (public preview) of Restart Frequency there are six different metric groups. If a reboot or shutdown does not go through the normal Windows procedure it is considered an abnormal restart. If there is an abnormal restart that is not caused by either a blue screen or a long power-button press the unknown category is used. The three remaining categories (Update, Restart, and Shutdown) are considered normal restarts.

  • Blue screens – If a device experiences a blue screen / stop error event.
  • Long power-button press – If a user holds down the power button, for example resolve a non-responsive system.
  • Update – A restart was required to complete a feature or security update.
  • Restart (no update) – Any restart that is not required due to a system update or feature update. Microsoft insists that these values should be close to zero as they dont see any other reason for reboots other than monthly patching. Personally i dont agree with this vision as there could be other valid reasons to restart the system.
  • Shutdown (no update) – User issuing a controlled system shutdown from Windows.
  • Unknown – Any abnormal restart that is not covered by any other metric group.

Note that the Restart Frequency tab displays information for the last 30 days according to the UI., however the documentation says only 14 days. Microsoft might be updating this threshold and might not have updated the documentation yet.

Restart Frequency metrics

Device Performance

In the Device Performance tab there are now two new columns that indicate the amount of reboots and the amounts of blue screens per system in the last 14 days. This is useful information for operations and helpdesk to find devices that are having problems.

Device Performance

Device Specifics

If we select a specific device we can get additional device specific information on restart. If there is a blue screen we can get the stop code without having to contact the user directly. The Failure Bicker ID can be provided to Microsoft Support to troubleshoot issues.

Device Specifics

Model Performance

In the Device Performance tab there are also two additional columns that display average reboots and blue screens for a particular device model. Note that at least 10 devices of the same model is required in order for information to be displayed. The Average Blue Screen column would give a good indication if there was a particular device model in the organization with a bad driver or configuration that is causing blue screens.

Model Performance

Want To See More?

AutoPilot

Windows Autopilot Diagnostics

Microsoft has announced a new Autopilot Diagnostics screen that makes it much easier to troubleshoot and retrieve logs during deployment. The scenario only work with

Linux

Installing pfSense on Hyper-V

Having a lab environment on your laptop/desktop machine can be practical to test new functionality and learn new products and services. However it can be