There are other circumstances that may generate an 0x500ff reason code for a shutdown but the one I found today was very unexpected. It turns out this is the reason code that generates when a user clicks the Restart Now button on the Windows Update restart reminder window. The issue came up in trying to figure out if a specific user was rebooting the server. The event log did report the user that was doing this but didn’t give a description for the shutdown like you would normally expect in the event log when somebody clicks Start -> Shutdown.
The process C:\windows\system32\winlogon.exe (hostname) has initiated the restart of computer SMR-RDP-S2 on behalf of user Username for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: restart