🕵️ Detective Mission · Intermediate · ~25 minutes
The Case of the Midnight Reboots
Case #DET-0117 — WEB01
- Reported by
- Monitoring alerts (no human witness)
- Incident
- WEB01 rebooted unexpectedly 3 times this week — Oct 10, 11, and 12, each at approximately 02:00.
- Complication
- No change request, no admin on shift, no one admits to scheduling anything.
- Your role
- Detective. This isn't a broken thing to fix — it's a mystery to solve. Gather clues, form a hypothesis, prove it.
Simulated environment — fictional server, no real systems affected.
Investigation Terminal
Simulated PowerShell session on WEB01. Start with the event log: Get-WinEvent -LogName System
Phase 2 — State your hypothesis
Three theories. The evidence supports exactly one. Choose carefully — a detective commits.
Phase 3 — Prove the chain
A hypothesis is a guess until you prove causation. Click your pinned clues in causal order — what fires first, what runs next, what gets recorded last.
🕵️ The twist
J. Morrow, a former admin, wrote NightlyCleanup.ps1 in 2024 for legitimate nightly disk cleanup. The Restart-Computer -Force line at the bottom was a testing leftover — flagged with a TODO comment, never removed. The task isn't malicious. It's a forgotten TODO doing exactly what it was told, every night at 02:00.
Phase 4 — Resolution
What's the right fix, detective?
📋 Case Report
Genie guide
Collect at least three clues from the terminal, form a hypothesis, then prove the causal chain before writing the case report.
Simulated environment — fictional server, no real systems affected.
Reading 1 of 9 sections
Error decoder
Paste the red text. The decoder names the kind of error it is and points at the lesson that fixes it. It never runs your code, and decoding happens entirely in your browser — your pasted error is never sent anywhere.