I've had 5 machines the past two days, that have randomly restarted in the morning. All of my GPO's are configured to prevent reboots from Windows Updates. All 5 machines have up to date Anti-Virus, have ran a combofix with nothing found, and have been forcefully rebooted at least once (most twice). I'm hoping to find the root cause, so I can prevent it from occurring on any other machines in our environment.
Also, sometimes on the seconds reboot the users see a:
"
The description for Event ID 1074 from source USER32 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
HOTFIX.exe
%Computer_Name%
No title for this reason could be found
0x2
restart
NT AUTHORITY\SYSTEM
The handle is invalid
"