Restarting Computers

Patches, firmware changes and stuck machines all end the same way: the computer needs a restart. Athena has a built-in Restart computer action. It restarts one Windows device, a selection from the Agents list, or every member of a collection, after a delay you choose. Anyone signed in to the device gets a Windows warning first. You don't write a script for it, and you don't need the right to run arbitrary commands.

Where to find it#

The same action, with the same confirmation dialog, appears in four places:

The buttons only appear for accounts that hold the agents.restart permission (see Permissions). The permission is checked again when you confirm, so a button left open in an old browser tab can't get around it.

The confirmation dialog#

Every restart goes through a Restart computer confirmation. It names the target (a hostname, or "N computers") and warns that anyone signed in sees a Windows warning with the delay, that unsaved work is lost, and that the action is Windows only.

In a bulk request (the Agents list or a collection), every device gets the same delay. The delay is the only thing you can set. You cannot change the command Athena runs or the message the user sees.

What happens on the device#

Athena sends the restart as a normal remote command. It runs as SYSTEM, and the command itself is fixed:

shutdown.exe /r /t <seconds> /c "<notice>"

The notice shown to the signed-in user is also fixed. It depends only on the delay:

All the selected devices go into one command, so the restart appears in the command history like any other command. It is recorded under your user name, and you can see the result for each device there.

Inventory refreshes by itself afterwards. When a device that was sent a restart reconnects, Athena asks it once for a full inventory collection. Views that depend on a reboot then update without you doing anything, for example the Secure Boot certificate card's Pending restart state or the Restart Pending flag. That follow-up collection is recorded as requested by System (after restart).

Outcomes per device#

Each device in a request gets one of these outcomes:

For a bulk request, the console shows one summary instead: Restart sent to X of Y computers (A offline, B not Windows). It is a success message if at least one device was sent the restart, and a warning if none were.

Cancelling a pending restart#

Athena has no "cancel restart" button. While the delay is still counting down, you can abort the restart by running this Windows command on the device as a remote command (this needs commands.execute):

shutdown /a

If you cancel, the device doesn't drop its connection, so the automatic inventory refresh doesn't run straight away. It runs the next time that device reconnects to the server.

Permissions#

Restarting has its own permission, agents.restart: Restart a device (Windows), after a delay the operator chooses and the logged-on user is told about. Out of the box, Operator and Admin hold it. User and Helpdesk do not. Athena runs a fixed command for you, so restarting does not need commands.execute. You can let operators restart machines without also letting them run any script they like. See Permission Model & Role Bundles.

Without the permission, the restart buttons are hidden and both REST endpoints return 403.

REST API#

# One device, restart in 5 minutes
POST /api/agents/550e8400-e29b-41d4-a716-446655440000/restart
{ "delaySeconds": 300 }

# A collection's members plus one extra device, restart in 1 minute
POST /api/agents/restart
{
  "agentIds": ["550e8400-e29b-41d4-a716-446655440000"],
  "collectionId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "delaySeconds": 60
}

Both endpoints return the per-device result: agentId, hostname, status (one of the outcomes above), commandId when the restart was sent, and reason when it was not.

From PowerShell, call these endpoints with Invoke-RestMethod. The Athena module does not have a dedicated restart cmdlet. See the API Reference for authentication.

Auditing#

Each request writes one AgentRestartRequested event at Warning severity to the audit log. This happens whether the request came from the console or the API, and even when no device was sent the restart. The description records the delay, who asked, how many agents were targeted, the command ID when one was sent, and the hostnames grouped by outcome (dispatched, offline, not supported, failed, not found). For a single-device request, the event's resource is that agent, so it shows up in the agent's own audit trail. See Audit Event Types.

Troubleshooting#