Windows VM Unexpected Reboot: Guest OS Event ID 1074 in VMware Environments

Products

• VMware vSphere ESXi

Issue/Introduction

Windows virtual machines (VMs) running on VMware vSphere or VMware Cloud Foundation (VCF) experience unexpected reboots without any prior administrative action in vCenter Server. No host-level hardware failures or HA (High Availability) events are recorded at the time of the restart.

Symptoms:

• The VM reboots automatically despite no planned maintenance in vSphere.
• The vSphere Client Tasks & Events console does not show a Reset VM or Power Off task.
• The /vmfs/volumes/<datastore>/<vm-name>/vmware.log  for the VM may contain: vcpu-0 - Chipset: The guest has requested that the virtual machine be hard reset.
• Windows Event Viewer shows
  • The process C:\WINDOWS\servicing\TrustedInstaller.exe (Hostname) has initiated the restart of computer Hostname on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Upgrade (Planned)
Reason Code: 0x80020003
Shutdown Type: restart
Time: DD/MM/YYYY hh:mm:ss (Local system time)
  • The process C:\WINDOWS\system32\svchost.exe (Hostname) has initiated the restart of computer Hostname on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned)
Reason Code: 0x80020010
Shutdown Type: restart
Time: DD/MM/YYYY hh:mm:ss (Local system time)

Environment

• VMware vSphere 8.X
• Windows Servers

Cause

• The reboot is initiated from within the Windows Guest Operating System layer. This commonly occurs due to automated Windows Update servicing, planned upgrades, or internal system tasks (such as TrustedInstaller.exe or svchost.exe).

Resolution

Check the Windows System Event logs to identify the specific process that requested the shutdown.

• Log in to the affected Windows VM.
• Open Event Viewer (eventvwr.msc).
• Navigate to Windows Logs > System.
  • Filter the log for Event ID 1074.
  • Review the User, Process, and Reason Code fields:
    • Process: C:\Windows\servicing\TrustedInstaller.exe indicates an update-triggered restart.
    • Process: C:\Windows\system32\svchost.exe (Reason: Service Pack/Planned) indicates automated patch management.
• Coordinate with your internal Windows Administration team to adjust maintenance windows or update policies in Group Policy (GPO).
• Engage Guest OS vendor to investigate further into the issue.