8

Windows has the command shutdown /t to shutdown or restart the computer after a certain delay. A pending shutdown can be aborted with shutdown /a.

But how can I determine whether and when a shutdown is currently pending or scheduled, without aborting it?

  • Shutdown.exe will record events in the Windows SYSTEM Event log with a Source=User32. When a Shutdown command is issued with a timeout of > 120 seconds, event ID 1074 is logged. – DavidPostill Jan 19 '16 at 11:02
  • I can find this message in the event log. But it doesn't say when the restart is scheduled for. It just tells the user and reason. – ygoe Jan 19 '16 at 11:06
  • You need to know the time of the pending shutdown? Please add this important information to your question (you have just invalidated the answer I was writing :/) – DavidPostill Jan 19 '16 at 11:08
  • Anything useful from the -d option? Shutdown. Maybe you can find useful the Shutdown Event Tracker. – Hastur Jan 19 '16 at 11:12
  • I have added the information to the question. /d specifies the shutdown reason, which I did. This information was recorded in the event log. But not the timeout from /t. Shutdown Event Tracker does not seem to be useful. It does not show the timeout, and it needs to be set up in advance. – ygoe Jan 19 '16 at 11:17
9

How can I determine whether and when a shutdown is currently pending or scheduled, without aborting it?

I don't think it is possible to determine when the shutdown will happen.

You can determine if a shutdown is scheduled using the following algorithm:

  1. Run a "test" shutdown using shutdown /t xxx with a large value for the time.

    • For Windows 7 or later the maximum time allowed was increased from 600 seconds to 315,360,000 seconds (10 years)
  2. If there is already a shutdown pending then shutdown /t xxx will fail with errorlevel 1190:

    A system shutdown has already been scheduled.(1190)

  3. If you don't get the above error then you know there was no previous shutdown scheduled, so you need to delete the "test" shutdown using shutdown /a.

The above can be done in a batch file:

@echo off
rem perform a "test" shutdown with a large time
shutdown /t 999999
rem if there is already a shutdown pending then %ERRORLEVEL% will be 1190
if %ERRORLEVEL% equ 1190 (
  echo A shutdown is pending
  ) else (
  rem cancel the "test" shutdown
  shutdown /a
  echo No shutdown is pending
  )

Note:

  • I haven't tested the above batch file as I don't wish to shutdown my PC at this time.

Further Reading

0

A rather more complicated way of finding out whether or not a shutdown is scheduled is to debug winlogon.exe and check the status of the ShutdownInProgress flag. You'll need debugging tools for Windows.

I haven't tried it but this MSDN blog post explains what happens behind the scenes when Windows shuts down and how to debug winlogon.exe (which is a kernel process). The debugger command to get the status of the flag seems to be:

dd winlogon!ShutdownInProgress l 1
01062b3c  00000000

If you know how to debug kernel processes in Windows, you could try it out. This beginner's guide to debugging with CDB and NTSD might help.

  • Uhm... Interesting. :-) That will tell me as much as the error message from a probing shutdown /t 99999, right? – ygoe Jan 19 '16 at 16:36
  • 2
    @LonelyPixel Right. This method is only for the masochists :) – Vinayak Jan 19 '16 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.