Does anyone happen to know if a required restart in order to apply Windows Updates creates a entry in the event log? If so which log is it under, and what is the source/id?
I have a legacy system that needs to an account, constantly logged into console for applications to function as required (Some old PROCOMS modem software for customers without Internet access but a telephone (Dial-up? Separate issue, don't get me started -.-)).
When an update is applied to this machine that requires a restart (Server 2003) I would like an e-mail alert to be sent.
This is the event you are looking for, down the keyword it triggers. I believe it is safe to assume it will be identical on all Windows systems at least as old as Windows 7 or newer.
PS:I hope this answer doesn't get downvoted because the screenshot is from a Windows 7 machine, as opposed to a server product.
How are your WSUS updates being applied? Automatically installed then prompt for a reboot, or automatically downloaded then prompt for install? You never want to leave a production server in a state where the patches have been installed and it's requesting a reboot. This leaves the server in an 'intermediate' state where it's neither at one patch level or another. Ideally you always want to trigger the patch installation (manually) then reboot the server immediately upon completion.
Whenever a server reboots there should be an Event ID 6009 from source eventlog stating the product name, version, build number, service pack number, and operating system type.