Quick Links
Windows does a lot of work in the background when you shut down, restart, or sign out of your PC. The process ensures all your work and application data is saved before the hardware powers off.
Windows Checks for Logged in Users (on Shut Down)
When you tell your PC to shut down or restart, Windows first checks to see if any other Windows user accounts have active sessions. This occurs when you lock your Windows session and sign in with another user account before signing out first.
If Windows does notice another user hasn't properly signed out yet, you'll see a "Someone else is still using this PC" message. That other user could lose any unsaved data in open applications if you forcibly restart. It's usually a good idea to stop here and let the other user sign in, save their work, and log out before shutting down.
Windows lets you click "Shut down anyway" if you're sure the other user doesn't have any open work to save. This will forcibly sign the other user account out, closing all their open applications. Any unsaved data will be lost.
If you're the only signed in user, you won't see this message and Windows will go straight to the next step.
Windows Tells Programs to Save Their Work and Close
Before actually signing you out of your PC, Windows tells all your open programs to save their work and close. This also occurs when you shut down or restart your PC since signing you out is a necessary part of the shutdown process.
Specifically, Windows sends the WM_QUERYENDSESSION message to each open window. It doesn't just forcibly close any open programs. Programs are told to save their work and close, and they may take a moment before doing so. This is why it can sometimes take a bit to shut down or sign out of your PC.
Programs can "block" this process by saying they need user input from you. For example, a program might have open files you need to save. You'll see a "This app is preventing shutdown" message if an application is asking for input. An application can also display a custom message here with the ShutdownBlockReasonCreate function.
If you see this message, you should click "Cancel," check the application, save your data, and close it yourself. If you're fine discarding the data, you can continue by clicking "Shut down anyway" or "Sign out anyway" instead.
Note that Windows closes other applications as they're ready. So, if you have ten applications open and only one is preventing you from shutting down, you'll see just that single application if you click "Cancel" here. Windows will have already closed the other nine applications.
On Windows 10, Windows will also remember which application windows you had open and try to re-open them the next time you sign into your PC.
Windows Logs You Out
After telling all your open programs to save their data and shut down, Windows logs you out. The entire Windows "session" belonging to your user account is ended, and no open programs will continue running as your user account.
Lots of individual actions go into cleanly signing out of Windows. For example, the contents of your user account's Windows registry hives are normally stored in memory. When you sign out, they're saved to disk. They will be loaded back into memory the next time you sign in.
If you're just signing out, Windows returns you to the sign-in screen so you can sign in as another user. If you're shutting down or restarting, Windows continues the shutdown process
Windows Shuts Itself Down
After Windows finishes signing out any users, it only has itself to shut down. Windows tells any system services and its own processes to shut down cleanly, saving any necessary data to disk. Specifically, it sends the SERVICE_ACCEPT_PRESHUTDOWN message to any running services. After the services have been warned, they receive a SERVICE_ACCEPT_SHUTDOWN message. The service then has 20 seconds to clean up and shut down before Windows forcibly shuts it down.
Windows 10 will save the state of your Windows kernel to disk, too. It's like a partial hibernate. The next time you start your PC, Windows can reload the saved kernel and boot up more quickly, skipping the slower hardware initialization process. This feature is called "Fast Startup."
Windows will also work on applying any available Windows Updates during the last parts of the shutdown process. Windows performs different update tasks at shutdown, before the PC starts, and in the background while it's running.
When everything is done, Windows will cleanly unmount your solid-state drive or hard drive, waiting for an "all clear" signal that indicates all the system's data has been saved to the physical disk. All the software has been cleanly shut down, and all your data is saved to disk.
Windows Shuts Off Your PC
Finally, Windows sends an ACPI shutdown signal to your PC. This tells your PC to power itself off physically. The shutdown process is finished.
If you ever used Windows 95, you'll remember the days before the ACPI shutdown signal. Windows displayed an "It is now safe to turn off your computer" message at this step, and you had to press the physical power button yourself. The ACPI (Advanced Configuration and Power Interface) standard, first released in 1996, lets Windows power the PC off.
This works differently from using sleep or hibernate. With sleep, your PC will stay powered on in a very low-power mode. With hibernate, your PC will save its entire system state to disk and restore it when you power it on once again.