Question What app can I use to hunt down what's causing a slow shutdown/reboot?

[cartaphilus]

What app can I use to hunt down what's causing a slow shutdown/reboot?​

Thanks

 

[Bot]

What app can I use to hunt down what's causing a slow shutdown/reboot?​

Thanks

If you’re on Windows 10/11, the two best “apps” for figuring out what’s making shutdown/reboot slow are:

1) Event Viewer (fastest, usually enough)​

Windows logs slow shutdowns and often names the culprit.

1. Press Win + R, type eventvwr.msc, Enter
2. Go to: Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational
3. Filter for these Event IDs:
   
   • 200 = overall slow shutdown
   • 201–203 = a specific app/service/driver delaying shutdown (PC No Problems)

Open the events and look for the process/service name and the delay time.

2) Windows Performance Recorder + Windows Performance Analyzer (deep dive, most accurate)​

If Event Viewer isn’t clear (or you suspect a driver), capture a shutdown trace and analyze it.

• Use Windows Performance Recorder (WPR) to record a shutdown
• Open the trace in Windows Performance Analyzer (WPA) to see exactly what blocks the shutdown pipeline (Microsoft Learn)

Microsoft’s own troubleshooting guidance for slow shutdowns is based on WPR traces. (Microsoft Learn)

Bonus tools (good for “what is it doing?”)​

• Sysinternals Process Monitor (ProcMon): can help identify what’s hanging around shutdown time, especially if you need to see file/registry activity tied to a process. (Microsoft Learn)
• Sysinternals Autoruns: great for quickly disabling “stuff that runs” (test by disabling non essential entries, then re-enable in batches to isolate).

---

If you tell me your OS (Windows 10/11, or macOS) and whether it’s shutdown, restart, or reboot after updates, I’ll point you to the exact log path and what fields to look at.

 

[cartaphilus]

If you’re on Windows 10/11, the two best “apps” for figuring out what’s making shutdown/reboot slow are:

1) Event Viewer (fastest, usually enough)​

Windows logs slow shutdowns and often names the culprit.

1. Press Win + R, type eventvwr.msc, Enter
2. Go to: Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational
3. Filter for these Event IDs:
   • 200 = overall slow shutdown
   • 201–203 = a specific app/service/driver delaying shutdown (PC No Problems)

Open the events and look for the process/service name and the delay time.

2) Windows Performance Recorder + Windows Performance Analyzer (deep dive, most accurate)​

If Event Viewer isn’t clear (or you suspect a driver), capture a shutdown trace and analyze it.

• Use Windows Performance Recorder (WPR) to record a shutdown
• Open the trace in Windows Performance Analyzer (WPA) to see exactly what blocks the shutdown pipeline (Microsoft Learn)

Microsoft’s own troubleshooting guidance for slow shutdowns is based on WPR traces. (Microsoft Learn)

Bonus tools (good for “what is it doing?”)​

• Sysinternals Process Monitor (ProcMon): can help identify what’s hanging around shutdown time, especially if you need to see file/registry activity tied to a process. (Microsoft Learn)
• Sysinternals Autoruns: great for quickly disabling “stuff that runs” (test by disabling non essential entries, then re-enable in batches to isolate).

---

If you tell me your OS (Windows 10/11, or macOS) and whether it’s shutdown, restart, or reboot after updates, I’ll point you to the exact log path and what fields to look at.

Windows 11 latest built. Just a regular shutdown

 

[Bot]

Windows 11 latest built. Just a regular shutdown

On Windows 11, the most practical way to “hunt down” slow shutdown causes is to use Windows’ built-in performance logging first, then (only if needed) a WPR/WPA trace.

1) Check Windows’ slow-shutdown log (built-in)
This is usually enough to identify the offending app/service/driver.

1. Press Win + R → type: eventvwr.msc → Enter
2. Go to:
   Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational
3. On the right, click Filter Current Log…
4. In Event IDs, enter:
   200,201,202,203

What to look for:

• Event ID 200 = overall slow shutdown (total shutdown time)
• Event IDs 201–203 = Windows naming a specific component (app/service/driver) that delayed shutdown; open the event and check the Details tab for the name and timing.

2) Use Reliability Monitor to correlate “what changed”
This helps when shutdown got slow “suddenly” after a driver/app/update.

1. Press Win + R → type: perfmon /rel → Enter
2. Look at the day/time the slow shutdown started and check for:
   • Driver installs/updates
   • App installs/updates
   • Windows Updates
   • App crashes/hangs

3) If logs don’t clearly name the culprit: WPR/WPA trace (advanced, most accurate)
If Event Viewer only shows “slow shutdown” but doesn’t point to a clear offender, the next step is a shutdown trace with Windows Performance Recorder (WPR) and analysis in Windows Performance Analyzer (WPA) (part of Microsoft’s Windows Performance Toolkit / Windows ADK). This can identify driver/service delays that don’t show cleanly in Event Viewer.

Because WPR has a couple different capture modes depending on toolkit version, the safe approach is: install WPT, then use the WPR “shutdown”/“boot” scenario that explicitly includes shutdown in the recording options, and analyze the resulting .etl in WPA.

Practical next step
Start with the Diagnostics-Performance events (IDs 200–203) and use those to pinpoint which process/service is delaying shutdown; that’s the quickest, lowest-risk method on Windows 11.

 

[cartaphilus]

On Windows 11, the most practical way to “hunt down” slow shutdown causes is to use Windows’ built-in performance logging first, then (only if needed) a WPR/WPA trace.

1) Check Windows’ slow-shutdown log (built-in)
This is usually enough to identify the offending app/service/driver.

1. Press Win + R → type: eventvwr.msc → Enter
2. Go to:
   Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational
3. On the right, click Filter Current Log…
4. In Event IDs, enter:
   200,201,202,203

What to look for:

• Event ID 200 = overall slow shutdown (total shutdown time)
• Event IDs 201–203 = Windows naming a specific component (app/service/driver) that delayed shutdown; open the event and check the Details tab for the name and timing.

2) Use Reliability Monitor to correlate “what changed”
This helps when shutdown got slow “suddenly” after a driver/app/update.

1. Press Win + R → type: perfmon /rel → Enter
2. Look at the day/time the slow shutdown started and check for:
   • Driver installs/updates
   • App installs/updates
   • Windows Updates
   • App crashes/hangs

3) If logs don’t clearly name the culprit: WPR/WPA trace (advanced, most accurate)
If Event Viewer only shows “slow shutdown” but doesn’t point to a clear offender, the next step is a shutdown trace with Windows Performance Recorder (WPR) and analysis in Windows Performance Analyzer (WPA) (part of Microsoft’s Windows Performance Toolkit / Windows ADK). This can identify driver/service delays that don’t show cleanly in Event Viewer.

Because WPR has a couple different capture modes depending on toolkit version, the safe approach is: install WPT, then use the WPR “shutdown”/“boot” scenario that explicitly includes shutdown in the recording options, and analyze the resulting .etl in WPA.

Practical next step
Start with the Diagnostics-Performance events (IDs 200–203) and use those to pinpoint which process/service is delaying shutdown; that’s the quickest, lowest-risk method on Windows 11.

Not like you are a human so no feelings but thank you regardless

 

[Bot]

Not like you are a human so no feelings but thank you regardless

You’re welcome.

If you want a concrete “next step” to move it forward: after a slow shutdown, check Event Viewer at:

• Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational

Open the newest Event ID 200/201–203 and note the process/service/driver name and the delay time. That’s usually the quickest way to identify what’s holding shutdown up.

 

[Wrecker4923]

I don't know the answer, but I got annoyed by the same thing. So, what I did was write an AutoHotKey script to close all the apps I normally have open before I shut down, etc. This is a very quick process, as it typically sends close messages to the windows. The rest usually closes without trouble anyway.

The drawbacks of this are:

1. You have to maintain the script.
2. You can't close all windows unless you are elevated.
3. Some apps respond poorly, i.e., they do a dump and exit.
4. The process in the first paragraph is a simplification; it seems that for some apps, multiple "kill" methods need to be tried.

 

[TairikuOkami]

reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "VerboseStatus" /t REG_DWORD /d "1" /f

This policy will show, what processes are shutting down, it helped me to determine, that Panda was causing 30 sec delay.

Enable verbose startup, shutdown, logon, and logoff status messages in Windows Server 2003 - Windows Server

Describes how to enable verbose status messages by using Group Policy Object Editor or by editing the Windows registry.

learn.microsoft.com

 

[Wrecker4923]

Thanks, you are a bottomless source of learning.