Right now we are in discussion regarding this topic with Avast since before christmas we got info from a bunch of customers that clients have been restarted related to Avast... Because of this I have set the policies to: "Restart after loggoff" (or something like that translated in english). Not sure if this works finally since we also in clarification if a shutdown will suffice compared to a restart. It seems that there are some situations where shutdown is not sufficient because of the fast startupmode of Windows...