Sometimes you might log onto a server and wonder if there have been patches installed and thing needs to be rebooted. Well if the patch wanted to replace a file that was in use by the system (like NTFS for example) then it populates a certain key in the registry, you could check this key to determine if a reboot is pending.
Location: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
Stores the names of files to be renamed when the system restarts.
This entry consists of pairs of file names. The file specified in the first item of the pair is renamed to match the second item of the pair. The system adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until the system is restarted and they are renamed.
Server that doesn’t need to be rebooted for pending files:
C:\>reg query “\\server1\hklm\System\CurrentControlSet\Control\Session Manager” /v PendingFileRenameOperations
ERROR: The system was unable to find the specified registry key or value.
Server that does need to be rebooted for pending files:
C:\>reg query “\\server2\hklm\System\CurrentControlSet\Control\Session Manager” /v PendingFileRenameOperations
PendingFileRenameOperations REG_MULTI_SZ \??\C:\WINDOWS\system32\SET2B5.tmp\0!\??\C:\WINDOWS\system32\schannel.dll\0\??\C:\WINDOWS\system32\_000025_.tmp.dll\0\??\C:\WINDOWS\system32\SET2B9.tmp\0!\??\C:\WINDOWS\system32\urlmon.dll\0\??\C:\WINDOWS\system32\SET2BA.tmp\0!\??\C:\WINDOWS\system32\shdocvw.dll\0\??\C:\WINDOWS\system32\SET2CA.tmp\0!\??\C:\WINDOWS\system32\kernel32.dll