i tried to lock the machine down in gpedit and i did it a little too well. so, i'm going to have to undo it. that's ok.

but, i've found a cbs log from last night that appears to have gotten me to the cause of the problem - an update. from windows.

but, i disable updates for exactly this reason; i haven't updated this machine since 2014, and am not sure if windows 7 can even receive updates anymore.

but, this is the entry that appears to be the root cause: "there has been a change in the health of windows update". this was accompanied by a lot of creepy messages about IIS servers, but that could just be how microsoft does it..

the problem is that i've explicitly told it not to do that.

and, it hasn't tried to do it since 2014. why now? if i can figure that out, i'm sure i'll be able to figure out why the machine rebooted, as well as why the firewall broke.