When I click the shut down button it gives me another screen saying shutting down:

shutting down

What is actually going on during this stage?

I think in Windows XP it would say something like saving setting before it would power off. However what settings are there to save if when you apply a theme or something it is saved when you click apply.

If it is unmounting the HD then surely it would be the same as force the shut down (pulling the plug)

  • 1
    Fushing any outstanding disk writes, closing services, ...
    – DavidPostill
    Nov 28, 2015 at 20:15
  • 16
    Drives are not properly unmounted when you pull the plug. Nov 29, 2015 at 4:24
  • 3
    Here is a good setting you may appreciate: superuser.com/questions/426029/… Nov 29, 2015 at 5:03
  • 8
    "when you apply a theme or something it is saved when you click apply" -- saved yes, saved to disk not necessarily. Disks are extremely slow. So some amount of RAM is used to cache data on disk. You can close your program any time you want and the OS will make sure the data gets written to disk eventually. But the OS needs electricity to work. If you simply yank the plug (remove laptop battery) then that unsaved data is lost. What's worse, you don't know how much is unsaved - the last line? Half of your settings? All your settings? From your point of view all you experience is corrupted data
    – slebetman
    Nov 30, 2015 at 7:01
  • 1
    This may interest you: some Linux systems show step-by-step updates of what the system does when it's shutting down. Here are a couple of examples: 1 2 (though neither of these shows the complete shutdown procedure; there are more items that come before). Windows goes through similar steps.
    – David Z
    Nov 30, 2015 at 12:53

2 Answers 2


There are a lot of things happening during a shutdown. Here are just a few examples:

  • Check to see if any user applications havent closed (like an unsaved document) and prompt the user if necessary
  • Stop background services
  • Wait for the termination signal from open running services and applications
  • Flushes cache to disk
  • Write log files
  • All users are logged out
  • End the shell
  • Start installing Windows updates if necessary and tell the OS to finish updates on boot if necessary
  • Send the ACPI shutdown signal (this is what turns the machine off)

Edit: Feel free to add more in the comments if you can think of other items.

  • 7
    On Linux, it also stores the entropy pool on disk. This is important for your next boot. Or am I wrong? Nov 29, 2015 at 2:36
  • 77
    Sends all of your "Private" information to Microsoft, in the case of Win10.
    – Lucien
    Nov 29, 2015 at 8:51
  • 30
    A good operating system would also inhibit laptop-lid induced suspend. I hate it when the shutdown procedure is what's resumed when I open the laptop again. Nov 29, 2015 at 11:30
  • 6
    @Ben it takes far longer than microseconds. thats why it takes so long
    – Keltari
    Nov 29, 2015 at 20:03
  • 5
    Each of those running processes including services and drivers get asked politely by the OS to stop what they are doing and clean up after themselves. They're not just killed off, that's before the OS gets to start tidying itself up with flushing buffers and caches
    – James
    Nov 30, 2015 at 11:59

The system registry is (maybe?) written to the disk. Back on XP I noticed that if you made any changes to the registry then pulled the power, the changes would not be saved. I'm not quite sure about this one, just pointing it out.

Here's an excerpt from a document that Microsoft released.

• System session shutdown. This phase includes the pre-shutdown notification and shutdown notification subphases:

• Pre-shutdown notification. Windows serially shuts down all services that registered to receive pre-shutdown notifications. Ordered services—services that have set up the shutdown order of dependent services—are shut down before non-ordered services.

• Shutdown notification. All services that registered to receive shutdown notifications are shut down in parallel. If all services have not exited after 20 seconds (in Windows Vista) or 12 seconds (in Windows 7 client operating systems), the system continues the shutdown. Processes and services that do not shut down in a timely manner are left running as the system shuts down.

• Kernel shutdown. The remainder of the system, such as all devices and drivers, are shut down during the kernel shutdown phase.

Basically what you're waiting on is each individual service to clean up and exit. Each service is given 12 seconds to exit before it's killed.

Half of the shutdown time is dedicated to shutting down system services. If you're really interesting in seeing what time is dedicated to what during your shutdown, Windows includes a tool for tracing shutdown time.

xbootmgr -trace shutdown -numRuns 3 -resultPath %systemdrive%\traces -postBootDelay 180 -traceFlags base

And to make sense of the generated file (be sure to run in %systemdrive%\traces)

xperf -i trace.etl -o summary.xml -a shutdown

Sources: Update: Links from Microsoft Servers no longer work






You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .