A server has rebooted early in the morning on the second Wednesday of each month for the past three months. No one was logged into the server at the time of the reboots, and there was no planned…

System event logs would show that a reboot occurred but require additional investigation to determine the root cause, making them a secondary step after checking the settings that govern scheduled behavior.

Microsoft releases updates on Patch Tuesday, the second Tuesday of each month, and servers configured for automatic updates may reboot in the early morning hours of the following day - explaining the second Wednesday pattern. Checking Windows Update settings (including active hours, automatic restart configuration, and update history) would directly reveal if scheduled automatic updates are causing the reboots. This is the most targeted first step because the pattern is characteristic of update-driven restarts.

Maintenance settings control general scheduled tasks but would not specifically explain a monthly pattern tied to the second Wednesday, which aligns more precisely with Windows Update behavior.

Security event logs track authentication, logon, and access events and would not contain information about the cause of scheduled or update-triggered reboots.