Section 6: Shutdown and Restart

The Big Picture: Closing a Shop for the Night

Closing a shop properly means: tell customers to leave, finish serving them, count the till, switch off the machines, lock the door. Closing it badly means walking out mid-sale with the lights on.

A PC does the same. A graceful shutdown lets every program and service finish its work and save its data before the power goes off. This section covers the three things the Start menu offers: Shut down, Restart, and the hidden twist in "Shut down" called Fast Startup.

6.1 Graceful Shutdown Sequence (Services Stop, Processes End)

What it is: When you choose Shut down or Restart, Windows runs an orderly sequence. Section 11 draws the whole chain; here are the key steps.

Why it can take time: a program that does not respond, a service that will not stop, or a large amount of data to flush each add delay. If you see "Waiting for..." on a blue screen during shutdown, Windows is waiting for such an item.

Why a hard power-off is bad: if you hold the power button for several seconds or pull the plug, the flush in step 6 never happens. Files being written can be damaged. Modern file systems (Chapter 19) have a journal that helps repair this, but you can still lose recent work.

6.2 Shut Down vs Restart vs Sign Out

Why Restart fixes problems: Restart really clears the kernel and all drivers from memory and loads them fresh. Plain "Shut down" with Fast Startup does not do that (see 6.3). That is why "have you tried restarting?" works, and why "I shut it down and turned it on" sometimes does not.

6.3 Fast Startup (Hybrid Shutdown)

What it is: Fast Startup (also called hybrid shutdown or hybrid boot) is a Windows 10 and 11 feature, on by default on many PCs, that makes the next start quicker.

When you click Shut down with Fast Startup on:

1. All user sessions are logged off, user programs closed   (like a normal shutdown)
2. The KERNEL SESSION is NOT closed. Windows hibernates it:
      kernel + loaded drivers' state  --->  hiberfil.sys
3. The PC powers off (S5)

On the next boot:

power button -> firmware -> boot manager -> sees saved kernel
-> loads it from hiberfil.sys (fast) -> logon screen

So it is a partial hibernate: your programs are not saved (they were closed), but the kernel and drivers are. Reading one file is quicker than starting the kernel and loading every driver one by one, especially on a hard drive.

Side effects to know:

Fast Startup needs hibernation switched on (Section 4). powercfg /a lists "Fast Startup" if it is available. You can turn it on or off in Control Panel → Power Options → "Choose what the power buttons do" (hedge: the option is hidden if hibernation is off). Do not change it in the lab.

6.4 The shutdown Command (Read About It, Do Not Run It in the Lab)

Windows has a command-line tool named shutdown. It is real and useful, but running it ends your session, so the lab does not use it.

An example you might see in a script: shutdown /r /t 60 (restart in a minute). Never use /f casually; it closes programs without letting them save.

Safety: Do not run shutdown commands while working through this chapter. Reading them is enough.

6.5 When Windows Restarts for Other Reasons

Summary