PowerShell automations · 2026-08-01

PowerShell: check if a Windows machine has a pending reboot

$cbs = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'
$wu  = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
$pfr = $null -ne (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name PendingFileRenameOperations -ErrorAction SilentlyContinue)
[PSCustomObject]@{
  ComponentServicing = $cbs
  WindowsUpdate      = $wu
  FileRenamePending  = $pfr
  RebootPending      = $cbs -or $wu -or $pfr
}

Notes before you run it

• PendingFileRenameOperations is the noisiest of the three; AV updates and installers set it for trivialities. Treat it as a weaker signal than the other two.
• A machine that shows a pending reboot for weeks is a machine whose updates are not actually applying; check uptime next (Fast Startup hides shutdowns that never reboot).

Finding out what is actually holding the reboot

Read the PendingFileRenameOperations value as a list of file paths rather than a simple boolean. Run (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name PendingFileRenameOperations).PendingFileRenameOperations to see exactly which files are queued for replacement. The file paths usually name the component waiting to be replaced, which is enough to identify the product. Antivirus agents and printer drivers are the common culprits here.

For the servicing side, check C:\Windows\Logs\CBS\CBS.log for the record of what servicing is mid-way through. The end of that file is the useful part. Knowing which product set the flag decides whether the restart is urgent or can wait for the maintenance window.

Why Fast Startup makes uptime lie

On Windows client builds, Fast Startup means a normal shutdown hibernates the kernel session rather than ending it. The next power-on resumes it. The result is that a user who shuts down every night can have an uptime of weeks, and the pending reboot flags survive, because nothing ever actually restarted. Restart, rather than shutdown and power on, always performs a genuine reboot.

Check the real figure with (Get-CimInstance Win32_OperatingSystem).LastBootUpTime. Treat a long uptime on a machine whose user insists they shut it down nightly as Fast Startup rather than a lie.

Rebooting from the script

Restart-Computer -Force restarts immediately and does not prompt, which is right for a maintenance window and wrong during the working day. shutdown /r /t 3600 /c "Updates will finish after a restart" gives the user an hour and a message, and shutdown /a cancels it if they call. Restart-Computer -ComputerName <name> -Force works remotely where WinRM is available.

Reboot only on the two strong signals. Restarting a machine because PendingFileRenameOperations was set by an antivirus update annoys people for nothing.

Configuration Manager adds a fourth location

Where ConfigMgr is installed, the client tracks its own pending state, which can be set when none of the three registry locations are. Query it with Invoke-CimMethod -Namespace root\ccm\ClientSDK -ClassName CCM_ClientUtilities -MethodName DetermineIfRebootPending. The returned object has RebootPending and IsHardRebootPending, and the hard reboot flag means a restart cannot be deferred.

The call fails on machines without the ConfigMgr client, so wrap it in a check for the namespace rather than letting it error on every other machine in the fleet.

Frequently asked questions

How do I check for a pending reboot in PowerShell?

Test the three locations Windows uses: the Component Based Servicing RebootPending key, the Windows Update RebootRequired key, and the PendingFileRenameOperations value under Session Manager. Any one of them being present means a restart is outstanding.

Does a pending reboot stop new updates installing?

Often, yes. Servicing will frequently refuse to start new work while a previous operation is waiting on a restart, which is why a machine can sit weeks behind on patches while reporting no errors at all.

Why does the pending reboot flag come back straight after restarting?

Either the machine did not genuinely restart, which Fast Startup makes easy on client builds, or an update is failing and being retried on each boot. Check (Get-CimInstance Win32_OperatingSystem).LastBootUpTime first to tell the two apart.

Is PendingFileRenameOperations on its own worth a reboot?

Usually not. Antivirus definition updates, printer drivers and ordinary installers set it for routine file replacements. Treat the Component Based Servicing and Windows Update keys as the signals worth acting on, and this one as background noise unless it persists.