Endpoint rebooted after patching but user was not notified before the reboot

Symptom:

• Reboot Action is configured to notify the user but the user reports the notification never presented
• Endpoint rebooted after patching when a user was logged in but Reboot Action is configured to skip the reboot if a user is logged in

Resolution:

These issues occur when the kausrtsk.exe process is not running.  This "helper" executable allows the interactive dialogue window to present to the end user.  It also is the task necessary to determine whether a user is logged into the endpoint at any given time.  If this task is not running, these functions will not work properly.  Reviewing Agent > Agent Logs > Agent Procedure log may reveal an entry similar to the following:

The Reboot Action fired properly and, not recognizing a logged on user, the endpoint rebooted.

The kausrtsk.exe process may not be running for a variety of reasons:

1.  The process was terminated via Task Manager
2.  The process did not launch at login because

• The process is blocked by a security program
• The necessary registry key has been removed
• The program has been removed from startup
• The logged on user was not recognized as logging in (see item #3 for detail)

3.  The user was not recognized because the logged on user was a remote user OR because the logged on user was local but the process has been configured to recognize remote users

Kaseya can recognize either local users OR remote users, but not both.  If the endpoint is primary used by remote users, you can add the -remote tag to the necessary registry key so that the remote user is recognized.  However, any locally logged on user would no longer be recognized.  By default, the product will recognize the local user.  If the endpoint is primarily used by local users, then it is generally advisable to not add the -remote tag.

For instructions on adding this tag to the registry, please review KKB000639.  

If this endpoint has a mix of both local and remote users, you may want to consider changing the Reboot Action to the option "Reboot every [X] at [TIME] after install" option.  See KKB000893 for additional information regarding this Reboot Action.  Scheduling this reboot to occur during off hours on a specific time will greatly reduce the likelihood that a reboot occurs while a user is logged in due to the user not being recognized.  However, if the endpoint is a server that is accessed during most hours, the "Do Not Reboot" action may be more appropriate.  The reboot can then be scheduled to occur at a more appropriate time.