Reboot campaigns

A reboot campaign gets a machine restarted by a deadline while letting the person using it pick a moment that suits them. You set the deadline and how many times they may put it off; Pardon asks, remembers their answers, and restarts the machine itself when time runs out.

What the user sees

1. The prompt

The first time Pardon runs a campaign on a machine, the user gets a centred prompt with the deadline in their own time zone, how many deferrals they have left, and a choice of how long to defer.

While deferrals remain, Defer is the primary button, so the low-effort answer is never "restart right now and lose my work". Picking a different length relabels the button to match:

Closing the prompt with the ✕ counts as a deferral of the selected length, and the note under the buttons says so.

Offer five or more lengths and the first three show as buttons, with the rest under More:

2. Close to the deadline

Pardon hides any defer length that would run past the deadline rather than quietly shortening it, so "4 hours" always means four hours. When none of them fit, the picker disappears and only Restart now is left, even if the user still has deferrals in hand:

With nothing left to defer to, the ✕ here just closes the prompt (dismissed) without using a deferral. The deadline still stands.

3. The final countdown

When the deferrals are used up or the deadline arrives, whichever comes first, the user gets the countdown. It has no ✕, ignores Alt+F4, and offers only Restart now. The line under your name is the campaign's reason.

The countdown always runs its full length, however late it is. Someone who comes back from two weeks' leave after the deadline gets the whole countdown to save their work, never a surprise restart.

A campaign file

{
  "schema": "campaign/v1",
  "campaign_id": "aug-security-reboot",
  "type": "reboot",
  "severity": "warning",
  "title": "Restart needed to finish security updates",
  "body": "This month's security updates are installed but won't protect your PC until it restarts. It takes about 4 minutes.",
  "policy": {
    "deadline": { "within_hours": 72 },
    "stale_after_hours": 168,
    "max_defers": 3,
    "defer_options": [
      { "label": "15 min", "minutes": 15 },
      { "label": "1 hour", "minutes": 60 },
      { "label": "4 hours", "minutes": 240 },
      { "label": "Tonight", "until": "tonight" }
    ],
    "countdown_seconds": 900,
    "force_apps_closed_after_seconds": 120,
    "reason": "Finishing this month's security updates",
    "prompt_timeout_seconds": 1800,
    "no_user_action": "wait",
    "only_if_reboot_pending": true
  },
  "branding": { "org_name": "Lakeside IT", "accent": "#1e3a5f" }
}

Keep campaign_id the same for every run of one campaign. Pardon keys its memory of deferrals on it, so a new id is a fresh start with a full set of deferrals.

Choosing a policy

Every field, with its default, is in the campaign reference (reference coming soon). The decisions that matter most:

• How long people get. The deadline (see below), max_defers (3 by default; 0 means no Defer button at all) and countdown_seconds (15 minutes by default).
• What they can pick. defer_options, each a label plus minutes or until. "tonight" means 6:00 PM local time (or 6:00 PM tomorrow if that has passed), and "tomorrow_09:00" means that time tomorrow. Up to four show as buttons; with five or more, the extras go under More.
• How hard the restart is. Pardon first asks Windows to restart politely so apps can prompt to save, then forces it after force_apps_closed_after_seconds (120 by default). null never forces, which means one unsaved document can block the restart.
• Only machines that need it. "only_if_reboot_pending": true skips machines that don't need a restart and marks the campaign done on them. If Pardon can't tell, it assumes a restart is needed.
• Empty desks. prompt_timeout_seconds (30 minutes by default) closes an unanswered prompt as timeout so your RMM isn't held up. Not answering never uses a deferral.
• A safety catch. stale_after_hours makes an old campaign that someone re-sends by mistake do nothing once its deadline is long past.

Deadlines

"deadline": "2026-08-25T17:00:00"
"deadline": { "at": "2026-08-25T17:00:00Z" }
"deadline": { "within_hours": 72 }
"deadline": { "at": "2026-08-25T17:00:00", "within_hours": 72 }

• An at time without a time zone means that wall-clock time on each machine, so "Friday 5 PM" is 5 PM wherever the laptop is.
• An at time with Z or an offset is one exact moment everywhere.
• within_hours counts from the first time this machine showed the prompt, so a laptop that was off all week still gets its full 72 hours.
• If you give both, whichever comes first wins.

How Pardon remembers

Pardon itself is not running between your RMM's checks; it remembers each machine's answers in C:\ProgramData\Pardon\state\<campaign_id>.json. Only SYSTEM and administrators can change that folder; users can read it.

That memory is what makes a deferral mean something. If a user picks Defer 4 hours and your RMM runs the campaign again 30 minutes later, Pardon shows nothing and exits 7 with suppressed_reason: "deferred". Four hours later, it prompts again. The deadline still wins: a deferral never pushes past it.

Deferrals belong to the machine, not the person. If two people are signed in and both defer, that uses one deferral, and the shortest length they chose is the one that counts.

Checking and resetting a machine

pardon.exe status --campaign aug-security-reboot --payload .\aug-security-reboot.json

{"schema":"status/v1","campaign_id":"aug-security-reboot",
 "state":{"defers_used":2,"defer_until":"2026-08-22T20:31:02Z","first_prompt_at":"2026-08-22T14:03:11Z","last_outcome":"deferred", "...": "..."},
 "derived":{"deadline":"2026-08-25T17:00:00Z","deferred_until":"2026-08-22T20:31:02Z","defers_remaining":1,"next_action":"suppressed"}}

next_action is what the next run would do (prompt, countdown, suppressed or no_session), worked out by the same rules a real run uses, without showing or changing anything. Leave out --payload to see only the stored state.

pardon.exe clear --campaign aug-security-reboot

clear forgets the campaign on that machine (its state and any reprompt task). It is safe to run blindly: clearing something that isn't there still exits 0.

The results you get

The two you'll see most are 4, deferred and 5, reboot_initiated. Pardon reports a restart before the machine goes down, so your RMM still gets the answer. A run that shows nothing on purpose is 7, suppressed, with detail.suppressed_reason saying why (for example deferred or not_pending). The CLI reference (reference coming soon) lists every code, and the results reference (reference coming soon) every field.

A deferral comes back like this:

"detail": {
  "defer": {
    "chosen_label": "1 hour",
    "chosen_minutes": 60,
    "defers_remaining": 2,
    "defers_used": 1,
    "defer_until": "2026-08-15T17:12:20-05:00",
    "deadline": "2026-08-15T18:00:00-05:00"
  }
}

After a restart Pardon caused, the next run sees that the machine has booted since and reports suppressed with restarted, so a campaign left on a schedule does not restart the machine again.

Nobody signed in

Run it as SYSTEM

Run reboot campaigns from your RMM or Intune as SYSTEM. In that mode Pardon's SYSTEM process owns the countdown and makes the restart call itself; the windows people see only display it. Ending the countdown window in Task Manager does not cancel the restart.

If you run Pardon as the signed-in user instead, it still works, but the user can end the process. On Windows Server, an ordinary user is not allowed to restart the machine at all, so a direct run there exits 10 restart_failed; run it as SYSTEM.

With several people signed in at once, everyone sees the prompt. If one of them presses Restart now during a countdown, the machine restarts once the others have answered or when the countdown runs out, whichever is first.

Without an RMM: reprompt tasks

Most RMMs re-run the campaign on a schedule, which is how a deferred prompt comes back. If you have no RMM, add --register-reprompt:

pardon.exe show --payload .\aug-security-reboot.json --register-reprompt

When the user defers (or doesn't answer), Pardon copies the campaign to C:\ProgramData\Pardon\campaigns\ and registers a one-off scheduled task, Pardon-Reprompt-<campaign_id>, that runs as SYSTEM when the deferral ends, shows the campaign again, and deletes itself. If nobody answered, it uses reprompt_minutes. There is only ever one task per campaign. Registering the task needs admin rights; without them Pardon still records and honours the deferral and prints a warning.