Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is the file C:\windows\system32\shutdown.exe necessary to shutdown or restart Windows?

share|improve this question
Try renaming it something else and see. – martineau Mar 14 '14 at 3:42
@MukulKumar Someone who wants to find out the effect, and knows that they can very easily reverse it? – Jon Bentley Mar 14 '14 at 13:19
@theGreenCabbage: You need to issue shutdown -s -t 0 - a plain shutdown only displays help. – LawrenceC Mar 14 '14 at 14:32
Unplugging the computer should shut it off, regardless of any file's name. – David Starkey Mar 14 '14 at 17:17
@DavidStarkey: "Shut off" and "shut down" are not the same thing, though. – PreferenceBean Mar 14 '14 at 18:39
up vote 30 down vote accepted

Your question of course originates from your answer at , in particular from kinokijuf's comment upon the initial revision of your answer.

As kinokijuf said, Windows is not Unix. On Unices and Linux, shutdown is indeed involved in the full shutdown process. It is the program that sends regular warning messages to logged-in users and that writes the /run/nologin file to prevent further logging-on a short while before the scheduled shutdown time.

On Windows NT, this is not the case.

The "Shut down" action on the "power button" on the Windows Explorer Start menu, the "Shutdown" menu option in Task Manager, REBOOT /S in TCC or Take Command, and other applications programs that allow you to shut the system down all initiate shutdown by directly calling one of two Win32 API calls: InitiateSystemShutdownEx() or ExitWindowsEx(). They don't do things indirectly by running the shutdown program. (That actually needs more code to do than just calling the Win32 API call.) The shutdown program, when one is doing a local shutdown, calls those same Win32 API calls too.

It's actually winlogon, csrss, and smss that are the programs that shut down Windows NT. In particular, it is winlogon that does the main work of processing deferred shutdown requests.

Further reading

share|improve this answer
You are truly a sensible answerer! I liked the way you traced back to the real situation through my profile. – Mukul Kumar Mar 15 '14 at 14:02
Note that on Linux systems, the shutdown command is not at all involved in the full shutdown process; while it may send warning messages or touch /run/nologin, all it does in regard to actually shutting down is to send the appropriate command to systemd, init, etc., and exit. The init process or its modern replacement systemd actually does the work of shutting down the system. – Michael Hampton Mar 15 '14 at 14:10
No, M. Hampton, sending the messages and stopping logons is a fully-fledged part of the full shutdown procedure. Don't go thinking that it has magically gone away with Linux. The manual pages for two Linux shutdowns are right in front of you. Thinking that is as wrong as the nonsense in the Introduction to Linux at TLDP which says that "UNIX is not made to be shut down". UNIX was indeed made to be shut down, and there are quite a lot of books over the past 40 years for UNIX professionals that cover the full procedure, with warning messages to users as step #1. – JdeBP Mar 15 '14 at 15:32
There are even books for Linux professionals. I'd plug Rod Smith's LPIC Study Guide, which has shutdown on page 22, but it's not in my library. Sorry, M. Smith. (-: My library has the likes of Coffin's SVR5 Reference (the warning users step described on pages 355 and 683), a SCO UNIX System Administrator's Guide (warnings to users as shutdown first step on pages 52–53), and even Fielder's/Hunter's UNIX System Administration (the whole of chapter 6 is about shutdown, with warning users at the beginning of the chapter). One can find many more books for professionals covering this. – JdeBP Mar 15 '14 at 15:38


Explorer doesn't call this command when you shut down from the Start menu.

Shutting down the system is possible with a Win32 API call (@JdeBP's answer provides great details on that if interested). The command is just a convenient way to do it from a script, scheduled task, or the Run dialog.

share|improve this answer
Actually, shutdown.exe does not even do a graceful shutdown. – kinokijuf Mar 14 '14 at 19:36
Careful with that answer! Explorer doesn't call that command, but other processes that shut down or restart windows do: and it's not just 'a convenient way to do it' if the script or scheduled task is an installer or a scheduled maintenance task from your sysadmin. – Nile Mar 14 '14 at 20:20
That doesn't make it "necessary", Nile. See the context of the question (which isn't in the question, but is in my answer and what is pointed to there) for the rebuttal that the questioner was questioning, and the statement about shutdown that the questioner originally made. (These parts of) installers are often written in compiled languages that just call the Win32 API, by the way. – JdeBP Mar 14 '14 at 22:09

As explained by ultrasawblade (upvote), the system shutdown is a Win32 API call to: ExitWindowsEx

The link also has an example on how to implement a shutdown from C. Also, you can do it from C# using P/Invoke (Platform Invoke). has a bunch of signatures available for use:

share|improve this answer

It is not necessary. shutdown.exe is just a utility to shut down a local or remote computer. It looks like shutdown.exe uses the Native API's NtShutdownsystem. While Windows uses ExitWindowsEx (as already mentioned).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.