As always, when I tag something here as IT, its usually something crazy, hard to find, or mind-blowing, or perhaps falls under the “I learned something new today” realm. This is one of those things: System Uptime.
As always, when it comes to Windows systems, its best to do a shutdown every night for general maintenance, updates, and system hygiene. That said, its not 1997 anymore so Windows is usually pretty reliable, and could likely run for days if not months without an actual reboot, but then you don’t get the usual monthly updates, and things may slow to a crawl if you’re running software memory leaks and such.
Anyways, so as part of pushing out some new software (a management agent), I noticed some computers not checking in despite nearly a week after the software was pushed out. I looked at my auditing agent and found that it was reporting uptime of nearly a month+ for some of the affected computers, so naturally since the group was relatively small, I just emailed everyone telling them to reboot if they haven’t recently (and adding that they should be shutting down nightly). Of course, I got a few replies where people were saying that they WERE in fact shutting down nightly.
So as someone who’s OK eating his own dog food, I checked my own computer in the auditor, and found that in showed my computer having 6 days of uptime despite the fact that I FOR SURE did a full shutdown yesterday and had to do a full startup this morning. Wow, the auditing software must be broken, so I sent in a ticket to the vendor to have them check it out.
After doing so though, I figured I’d look into this a little more, and found that in fact, my computer WAS reporting a 6 day uptime, which is likely what the auditing software was pulling from, so its not the software, but Windows, so, WHY?
That led me to this Reddit post, showing that despite the visible states Windows could be in as on, off, hibernating, and sleeping, there’s another “hidden” state if you have fast boot enabled, where its a pseudo hibernate mode (think hiber-sleep-inate). Great, more tricks!
That said, when shutting down a Windows computer with fast boot enabled, it actually puts the computer into that hiber-sleep-inate state, and not a full “off” state as one expects. The only way to get a true “cold boot” is to actually restart.
Link here: https://www.reddit.com/r/PowerShell/comments/1emwqmh/why_isnt_my_event_logs_last_boot_date_time/
So yet again, I learn something new, and really, I’d love to know how people find out about this crazy stuff??