# Workflow: Device restart enforcement

## Overview <a href="#workflow-devicerestartenforcement-overview" id="workflow-devicerestartenforcement-overview"></a>

Restarting devices occasionally is necessary to keep devices working in a healthy state. General advice is for users to turn off their devices at the end of the day. Many simply put them to sleep or do not perform a proper shutdown, leaving the system in memory.

Alongside this, patches will not be properly installed in many cases if the device has not been restarted; therefore, it is important to get to these devices and ensure they get restarted.

In many cases, restarting devices is a sensitive topic between IT and the user base, so this workflow offers them some opportunities to perform the restart themselves before an automatic restart is triggered.

## Changelog <a href="#workflow-devicerestartenforcement-changelog" id="workflow-devicerestartenforcement-changelog"></a>

V1.0.0.0 - Initial Release

## Dependencies <a href="#workflow-devicerestartenforcement-dependencies" id="workflow-devicerestartenforcement-dependencies"></a>

The following content must be installed for the workflow to function properly.

## Remote actions <a href="#workflow-devicerestartenforcement-remoteactions" id="workflow-devicerestartenforcement-remoteactions"></a>

* Restart macOS device
* Restart Windows device

## Campaigns <a href="#workflow-devicerestartenforcement-campaigns" id="workflow-devicerestartenforcement-campaigns"></a>

* Restart device - Invoke
* Restart device after delay - Invoke
* Restart device - workflow Invoke
* Restart device - last call - workflow Invoke

## Configuration <a href="#workflow-devicerestartenforcement-configuration" id="workflow-devicerestartenforcement-configuration"></a>

### Remote action configuration <a href="#workflow-devicerestartenforcement-remoteactionconfiguration" id="workflow-devicerestartenforcement-remoteactionconfiguration"></a>

The following remote actions must be configured with an API trigger. It can be combined with other execution triggers if the remote action is used outside of a workflow.

* **Restart macOS device**
* **Restart Windows device**

These remote actions come with two associated campaigns that must be published before use:

* **Restart device - Invoke**
* **Restart device after delay - Invoke**

For more information, please refer to the[ remote action](https://nexthink.gitbook.io/opd/user-guide/remote-actions/managing-remote-actions) and [workflow remote action thinklet ](https://nexthink.gitbook.io/opd/user-guide/workflows/creating-workflows/designer)documentation.

### Campaign configuration <a href="#workflow-devicerestartenforcement-campaignconfiguration" id="workflow-devicerestartenforcement-campaignconfiguration"></a>

The workflow comes with two associated campaigns that must be published before use:

* **Restart device - Workflow Invoke**
* **Restart device - Last call - Workflow Invoke**

For more information, please refer to the [campaign](https://nexthink.gitbook.io/opd/user-guide/campaigns/managing-campaigns) and [workflow campaign thinklet](https://nexthink.gitbook.io/opd/user-guide/workflows/creating-workflows/designer) documentation.

### Trigger configuration for the workflow <a href="#workflow-devicerestartenforcement-triggerconfigurationfortheworkflow" id="workflow-devicerestartenforcement-triggerconfigurationfortheworkflow"></a>

The workflow has been designed primarily to be run manually. For example, you can run an investigation that queries for non-server devices that have not been restarted for more than one week by using the NQL query below:

{% code title="Code" lineNumbers="true" %}

```
devices during past 7d
| where operating_system.name !in ["*server*"]
| where boot.days_since_last_full_boot > 7
```

{% endcode %}

Alternatively, you could also set a schedule for the workflow to be automatically triggered, as shown below:

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-052a2af02ec78299ce6b4228289f4f98b24054d6%2Fimage-20230920-065226.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**Note:** Once all the prerequisites and workflow are installed and configured, you can use the built-in validation feature that runs every time you save the workflow.
{% endhint %}

## Workflow Structure <a href="#workflow-devicerestartenforcement-workflowstructure" id="workflow-devicerestartenforcement-workflowstructure"></a>

This section describes the key steps in this workflow:

1. The workflow checks if the target device has restarted within the last day. If yes, the workflow terminates; if not, the workflow continues.

   <figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-ed60c827ea27b000c5ae2f0f570040dfb5074afb%2Fimage-20230920-070146.png?alt=media" alt=""><figcaption></figcaption></figure>
2. The workflow launches a campaign prompting users to restart their device or delay:

   <figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-0601817d575d615e0a2b541a9d6c34bdae96d1cf%2Fimage-20230920-065818.png?alt=media" alt=""><figcaption></figcaption></figure>
3. The workflow restarts within one minute if ‘Restart now’ is selected; otherwise, it will be delayed by 60 minutes or 24 hours, respectively.
4. Following the delay period, the workflow checks to see if a restart has occurred; if not, the steps highlighted below are repeated twice.

   <figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-4955f72ae0f7c3fca2fb9be6023292efd625a7f5%2Fimage-20230920-070749.png?alt=media" alt=""><figcaption></figcaption></figure>
5. Lastly, the workflow gives the user ample time to restart their device at a time of their choosing. If the user has not restarted by the end of the workflow, a warning campaign is launched before the remote action(s) Restart macOS / Windows device automatically executes on their device.

   <figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-76e75aa7da4b88ea66f565852f7e7450c90ced43%2Fimage-20230920-070707.png?alt=media" alt=""><figcaption></figcaption></figure>

   For more information, please refer to the [workflow documentation](https://nexthink.gitbook.io/opd/user-guide/workflows).
