Is the file C:\windows\system32\shutdown.exe necessary to shutdown or restart Windows?

  • 16
    Try renaming it something else and see.
    – martineau
    Mar 14, 2014 at 3:42
  • 10
    @MukulKumar Someone who wants to find out the effect, and knows that they can very easily reverse it? Mar 14, 2014 at 13:19
  • 8
    @theGreenCabbage: You need to issue shutdown -s -t 0 - a plain shutdown only displays help.
    – LawrenceC
    Mar 14, 2014 at 14:32
  • 9
    Unplugging the computer should shut it off, regardless of any file's name. Mar 14, 2014 at 17:17
  • 7
    @DavidStarkey: "Shut off" and "shut down" are not the same thing, though. Mar 14, 2014 at 18:39

4 Answers 4


Your question of course originates from your answer at https://codegolf.stackexchange.com/a/24011/18907 , in particular from kinokijuf's comment upon the initial revision of your answer.

As kinokijuf said, Windows is not Unix. On Unices and Linux, shutdown is indeed involved in the full shutdown process. It is the program that sends regular warning messages to logged-in users and that writes the /run/nologin file to prevent further logging-on a short while before the scheduled shutdown time.

On Windows NT, this is not the case.

The "Shut down" action on the "power button" on the Windows Explorer Start menu, the "Shutdown" menu option in Task Manager, REBOOT /S in TCC or Take Command, and other applications programs that allow you to shut the system down all initiate shutdown by directly calling one of two Win32 API calls: InitiateSystemShutdownEx() or ExitWindowsEx(). They don't do things indirectly by running the shutdown program. (That actually needs more code to do than just calling the Win32 API call.) The shutdown program, when one is doing a local shutdown, calls those same Win32 API calls too.

It's actually winlogon, csrss, and smss that are the programs that shut down Windows NT. In particular, it is winlogon that does the main work of processing deferred shutdown requests.

Further reading

  • 1
    You are truly a sensible answerer! I liked the way you traced back to the real situation through my profile. Mar 15, 2014 at 14:02
  • Note that on Linux systems, the shutdown command is not at all involved in the full shutdown process; while it may send warning messages or touch /run/nologin, all it does in regard to actually shutting down is to send the appropriate command to systemd, init, etc., and exit. The init process or its modern replacement systemd actually does the work of shutting down the system. Mar 15, 2014 at 14:10
  • No, M. Hampton, sending the messages and stopping logons is a fully-fledged part of the full shutdown procedure. Don't go thinking that it has magically gone away with Linux. The manual pages for two Linux shutdowns are right in front of you. Thinking that is as wrong as the nonsense in the Introduction to Linux at TLDP which says that "UNIX is not made to be shut down". UNIX was indeed made to be shut down, and there are quite a lot of books over the past 40 years for UNIX professionals that cover the full procedure, with warning messages to users as step #1.
    – JdeBP
    Mar 15, 2014 at 15:32
  • There are even books for Linux professionals. I'd plug Rod Smith's LPIC Study Guide, which has shutdown on page 22, but it's not in my library. Sorry, M. Smith. (-: My library has the likes of Coffin's SVR5 Reference (the warning users step described on pages 355 and 683), a SCO UNIX System Administrator's Guide (warnings to users as shutdown first step on pages 52–53), and even Fielder's/Hunter's UNIX System Administration (the whole of chapter 6 is about shutdown, with warning users at the beginning of the chapter). One can find many more books for professionals covering this.
    – JdeBP
    Mar 15, 2014 at 15:38


Explorer doesn't call this command when you shut down from the Start menu.

Shutting down the system is possible with a Win32 API call (@JdeBP's answer provides great details on that if interested). The command is just a convenient way to do it from a script, scheduled task, or the Run dialog.

  • Actually, shutdown.exe does not even do a graceful shutdown.
    – kinokijuf
    Mar 14, 2014 at 19:36
  • Careful with that answer! Explorer doesn't call that command, but other processes that shut down or restart windows do: and it's not just 'a convenient way to do it' if the script or scheduled task is an installer or a scheduled maintenance task from your sysadmin. Mar 14, 2014 at 20:20
  • 1
    That doesn't make it "necessary", Nile. See the context of the question (which isn't in the question, but is in my answer and what is pointed to there) for the rebuttal that the questioner was questioning, and the statement about shutdown that the questioner originally made. (These parts of) installers are often written in compiled languages that just call the Win32 API, by the way.
    – JdeBP
    Mar 14, 2014 at 22:09

As explained by ultrasawblade (upvote), the system shutdown is a Win32 API call to: ExitWindowsEx

The link also has an example on how to implement a shutdown from C. Also, you can do it from C# using P/Invoke (Platform Invoke). pinvoke.net has a bunch of signatures available for use:http://www.pinvoke.net/default.aspx/user32/exitwindowsex.html


It is not necessary. shutdown.exe is just a utility to shut down a local or remote computer. It looks like shutdown.exe uses the Native API's NtShutdownsystem. While Windows uses ExitWindowsEx (as already mentioned).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .