Section 11: What Happens During Shutdown and Startup (Complete Chain)

The Big Picture: Closing Up and Opening Up

You have now met every player: ACPI, drivers, services, S-states, hiberfil.sys. This section puts them in one story. Every time you press Shut down and later press the power button, the same long chain runs. Many of its links come from earlier chapters.

Here is the whole chain in two columns. Read each column from top to bottom. The left column is what happens when you shut down; the right column is what happens when you start up.

SHUTDOWN                                  STARTUP
+------------------------------------+   +------------------------------------+
| 1. You click Shut down             |   | 1. You press the power button      |
|    (Start menu, Ch 30)             |   |    (standby power, Ch 4)           |
+------------------------------------+   +------------------------------------+
| 2. winlogon / ExitWindowsEx        |   | 2. PSU: PS_ON, then PWR_OK         |
|    ask apps to close               |   |    ("power good"), Ch 4            |
+------------------------------------+   +------------------------------------+
| 3. User session ends; services     |   | 3. CPU leaves reset and runs       |
|    stop in order (Ch 12)           |   |    the firmware (Ch 5)             |
+------------------------------------+   +------------------------------------+
| 4. Kernel flushes caches to disk   |   | 4. Firmware tests hardware, finds  |
|    (Ch 19)                         |   |    the boot drive, starts the      |
+------------------------------------+   |    boot manager (Ch 5, Ch 6)       |
| 5. Drivers get power IRPs and      |   +------------------------------------+
|    power devices down (Ch 13)      |   | 5. Boot manager and loader load    |
+------------------------------------+   |    the kernel (or resume the Fast  |
| 6. ACPI enters S5 (or saves the    |   |    Startup image) (Ch 6)           |
|    kernel to hiberfil.sys first)   |   +------------------------------------+
+------------------------------------+   | 6. Kernel starts drivers, then     |
| 7. PSU standby power only          |   |    services (Ch 12, Ch 13)         |
+------------------------------------+   +------------------------------------+
                                         | 7. Logon screen; your session      |
                                         |    starts; desktop appears (Ch 6)  |
                                         +------------------------------------+

The sections below walk through each part.

11.1 Shutdown Request: Session Manager Notifies Apps

What it is: The first link is a request from you (or from Windows itself, for example after an update).

1. You choose Shut down from the Start menu (Chapter 30 describes the shell).
2. The request goes to the logon and session code. A program-visible call, ExitWindowsEx, starts the process. Windows also sends a message to every top-level window: "the session is ending".
3. Each program gets a chance to save its work. Programs that do not answer in time are listed in the "These apps are preventing shutdown" screen.
4. When all user programs have ended, your session closes (Chapter 9: its processes end; Chapter 24: your logon session is torn down).

This is user mode work (Chapter 8): ordinary programs and services doing ordinary tasks.

11.2 Services Stopped in Dependency Order

What it is: Windows services (Chapter 12) are background programs that started at boot. They must also be stopped in the right order.

• The Service Control Manager sends a stop request to each service.
• A service that depends on another stops first. For example, a service that needs networking stops before the networking service does. The order is the reverse of how they started.
• Services have a time limit to stop. A service that does not stop in time may be ended by force. A long wait here is a common reason for a slow shutdown.

11.3 Kernel Session Terminated (or Hibernated for Fast Startup)

What it is: Now the kernel (Chapter 8) takes over.

Shut down + Fast Startup ON   -->  kernel + drivers saved in hiberfil.sys  -> S5
Restart, or Shift+Shut down   -->  kernel session discarded               -> S5 or reboot

11.4 Power-Off Signal to the PSU Through ACPI

What it is: The last link is hardware.

1. The Power Manager sends power IRPs down every device's driver stack (Chapter 13). Each driver puts its device in D3 (Section 8).
2. Windows calls acpi.sys (Section 1), which runs the firmware's method (an AML method in the DSDT, Section 1.2) that enters S5. The chipset writes the sleep-type value to a special register.
3. The motherboard drops the PS_ON signal (the green wire from Chapter 4). The PSU switches its main rails (+12, +5, +3.3 V) off.
4. Only the standby rail (purple, +5 V standby) stays on: the power button, Wake-on-LAN and the clock circuits are still alive.

The fans stop and the lights go off. That is S5.

11.5 Startup: The Reverse of Chapter 6's Boot Chain

What it is: Startup is nearly a mirror image. Chapter 6 told the boot story from the firmware onwards; here we add the electrical start.

The differences by case:

11.6 One Timeline Per State

S3 sleep wake      key -> CPU restarts -> drivers wake -> screen on   (~1-3 s)
S4 hibernate wake  button -> firmware -> loader -> read file -> apps  (longer)
Fast Startup boot  button -> firmware -> loader -> restore kernel -> logon
Full boot          button -> firmware -> loader -> kernel -> services -> logon

Look at your own machine: Task Manager → Performance → CPU (Chapter 11) shows Up time, which tells you whether you do full restarts or rely on Fast Startup.

Summary