Windows does a lot of work in the background when you shut down, reboot, or log out of your PC. This process ensures that all your work and application data is backed up before the hardware is turned off.
Windows checks for logged in users (at shutdown)
When you ask your PC to shut down or restart, Windows first checks to see if other Windows user accounts have active sessions. This happens when you lock your Windows session and log in with another user account before logging out.
If Windows notices that another user has not yet disconnected properly, the message "Someone else is still using this PC" will display. If you reboot by force, this other user may lose unsaved data in open applications. It is usually a good idea to stop here and let the other user log in, save their work, and log off before closing.
Windows allows you to click "Stop Anyway" if you are sure the other user does not have an open job to save. This will forcibly disconnect the user's other account by closing all open applications. All unsaved data will be lost.
If you are the only user logged in, you will not see this message and Windows will go directly to the next step.
Windows tells programs to back up their work and shut down
Before you log out of your PC, Windows asks all your open programs to save their work and close it. This also happens when you shut down or restart your PC because disconnection is a necessary step in the shutdown process.
Specifically, Windows sends the WM_QUERYENDSESSION message to each open window. It does not necessarily close open programs. Programs are told to save their work and close it, and they may take a moment to do so. That's why sometimes it takes a little shutdown or disconnection of your PC.
Programs can "block" this process by indicating that they need your participation. For example, a program may have open files that you must save. A message "This application prevents shutdown" is displayed if an application requests an entry. An application can also display a custom message here with the button ShutdownBlockReasonCreate a function.
If you see this message, you must click "Cancel", check the application, save your data and close it yourself. If you want to delete the data, you can continue by clicking "Stop anyway" or "Disconnect anyway".
Note that Windows closes the other applications as soon as they are ready. Thus, if you have ten open applications and only one stops you from stopping, you will only see this application if you click "Cancel" here. Windows will have already closed the other nine applications.
On Windows 10, Windows will also remember which application windows you have open and will try to reopen them the next time you connect to your PC.
Windows disconnects you
After you tell all your open programs to back up and close their data, Windows disconnects you. The entire Windows "session" belonging to your user account is complete and no open program will work as your user account.
Many individual actions allow you to disconnect properly from Windows. For example, the content of your user account Windows registry hives are normally stored in memory. When you disconnect, they are saved to disk. They will be loaded into memory when you next login.
If you simply log out, Windows brings you back to the login screen so that you can login as a different user. If you shut down or restart Windows, the shutdown process continues.
Once Windows has finished disconnecting all users, it just has to shut down. Windows requires all system services and its own processes to shut down properly, saving all necessary data to disk. More precisely, he sends the SERVICE_ACCEPT_PRESHUTDOWN message to all services running. Once the services are notified, they receive a SERVICE_ACCEPT_SHUTDOWN message. The service then has 20 seconds to clean up and shut down before Windows stops it by force.
Windows 10 will also record the status of your Windows kernel on the disk. It's like a partial hibernation. At the next boot of your PC, Windows will be able to reload the registered kernel and boot faster, ignoring the slower boot process of the hardware. This feature is called "Quick Start."
Windows will also work on the application of available Windows updates during the final stages of the shutdown process. Windows performs various update tasks while stopped, before the PC starts, and in the background while running.
Once everything is finished, Windows will properly dismount your solid-state drive or hard drive while waiting for a signal that all system data has been saved to the physical drive. All software has been shut down cleanly and all your data is saved to disk.
Windows turns off your PC
Finally, Windows sends an ACPI shutdown signal to your PC. This tells your PC to turn off physically. The shutdown process is over.
If you have already used Windows 95, you will remember the days before the ACPI shutdown signal. Windows displayed the message "You can now shut down your computer safely" at this point and you had to press the physical power button yourself. The ACPI standard (Advanced Configuration and Power Interface), first released in 1996, allows Windows to turn off the computer.
It works differently from sleeping or hibernating. In standby mode, your PC will stay on in very low power mode. With Hibernation mode, your PC saves all of its system status to disk and restores it when you turn it back on.