What exactly happens when you shut down or sign out of Windows?

What exactly happens when you shut down or sign out of Windows?.

Windows does a lot of work in the background when you shut down, restart, or sign out of your PC. The process ensures that all of your work and application data is saved before the hardware is shut down.

Windows checks for logged in users (on shutdown)

When you tell your PC to shut down or restart, Windows first checks to see if other Windows user accounts have active sessions. This occurs when you lock your Windows session and sign in with another user account before you sign out first.

If Windows notices that another user hasn’t logged out properly yet, you’ll see the message “Someone else is still using this PC.” That other user could lose any unsaved data in open apps if they force restart. It’s usually a good idea to stop here and allow the other user to log in, save their work, and log out before closing.

Windows allows you to click “Shut Down Anyway” if you’re sure the other user doesn’t have any work open to save. This will forcibly close the other user’s account, closing all their open apps. Unsaved data will be lost.

If you’re the only user logged in, you won’t see this message and Windows will go directly to the next step.

Windows tells programs to save their work and close

Before you log off your PC, Windows tells all your open programs to save their work and close. This also happens when you shut down or restart your PC, since logging out is a necessary part of the shutdown process.

Specifically, Windows sends the message to each open window. It doesn’t just forcefully close open programs. Programs are told to save their work and close, and may take a moment before doing so. That’s why it can sometimes take a while to shut down or log out of your PC.

Programs can “block” this process by saying they need user input. For example, a program may have open files that it needs to save. You will see a “This app is preventing shutdown” message if an app requests information. An application can also display a custom message here with the function.

If you see this message, you should click “Cancel”, check the app, save your data and close it yourself. If you’re okay discarding the data, you can continue by clicking “Close Anyway” or “Log Out Anyway.”

Please note that Windows closes other applications when they are ready. So if you have ten apps open and only one is preventing you from closing, you’ll see only that app if you click “Cancel” here. Windows will have already closed the other nine applications.

In Windows 10, Windows will also remember which app windows you had open and try to reopen them the next time you sign in to your PC.

Windows logs off

After telling all your open programs to save their data and shut down, Windows closes it. The entire Windows “session” belonging to your user account is terminated, and no open programs will continue to run as your user account.

Many individual actions are taken to cleanly log out of Windows. For example, the contents of your user account’s Windows registry hives are typically stored in memory. When you log out, they are saved to disk. They will be loaded back into memory the next time you log in.

If you just signed out, Windows returns you to the sign-in screen so you can sign in as another user. If you are shutting down or restarting, Windows continues the shutdown process

Windows shuts down by itself

Once Windows is done logging off any user, it just has to shut down. Windows tells any system services and its own processes to shut down cleanly, saving the necessary data to disk. Specifically, it sends the message to any running service. Once the services have been warned, they receive a SERVICE_ACCEPT_SHUTDOWN message. The service then has 20 seconds to clean up and shut down before Windows forcefully shuts it down.

Windows 10 will also save the state of your Windows kernel to disk. It’s like a partial hibernation. The next time you start your PC, Windows can reload the saved kernel and boot faster, bypassing the slower hardware initialization process. This feature is called “Quick Start”.

Windows will also work on applying any available Windows Updates during the last parts of the shutdown process. Windows performs different update tasks at shutdown, before the PC starts, and in the background while it is running.

When all is done, Windows will cleanly unmount your solid state drive or hard drive, waiting for an “all clear” signal indicating that all system data has been saved to the physical drive. All software has been shut down cleanly and all your data is saved to disk.

Windows shuts down your PC

Finally, Windows sends an ACPI shutdown signal to your PC. This tells your PC to physically shut down. The shutdown process has finished.

If you’ve ever used Windows 95, you’ll remember the days before the ACPI kill signal. Windows displayed a “It is now safe to turn off your computer” message at this step, and you had to press the physical power button yourself. The ACPI (Advanced Configuration and Power Interface) standard, first released in 1996, allows Windows to turn off your PC.

This works differently than using sleep or hibernation. With sleep, your PC will remain on in a very low power consumption mode. With hibernation, your PC will save the entire system state to disk and restore it when you turn it back on.