SHUTDOWN.exe (for Terminal Services use: TsShutDn)

Shutdown the computer

      SHUTDOWN [logoff_option]  [/m \\Computer] [options]

    /i         Display the GUI (must be the first option)
    /l         Log off. This cannot be used with /m or /d option.
    /s         Shutdown.
    /r         Shutdown and Restart.
    /g         Shutdown and Restart, after restarting restart any registered applications.
    /a         Abort a system shutdown during the time-out period.
    /p         Turn off the local computer with no time-out or warning
               (only with /d)
    /h         Hibernate the local computer (can be used with /f )
    /e         Document the reason for an unexpected shutdown of a computer.

/m \\Computer A remote computer to shutdown. /t xxx Time until system shutdown in seconds. The valid range is xxx=0-600 seconds. [default=30] /c "Msg" An optional shutdown message [Max 127 chars] /f Force running applications to close. This will not prompt for File-Save in any open applications. so will result in a loss of any unsaved data. /d u:xx:yy List a USER (unplanned) reason code for the shutdown. /d P:xx:yy List a PLANNED reason code for the shutdown. xx = The Major reason code (0-255) yy = The Minor reason code (0-65536)

In Windows 7, the maximum /t timeout increased from 600 seconds to 315,360,000 seconds (10 years)
If you need to FORCE a shutdown, or target multiple computers at once; use PsShutdown instead.

Alert Messages to logged in users

Shutdown will display one or two alert messages to the user depending on the delay (set with /t) as follows:

< 3 minutes
- A custom popup alert appears immediately (default).
>=3 mins and <=10 mins - A custom popup alert immediately and then a generic popup alert 2 mins before shutdown.
> 10 mins and < 11 mins - A system tray alert (with custom message) appears immediately, and then nothing else.
>=11 mins - A system tray alert (with custom message) appears immediately, and then a generic popup alert 10 mins before shutdown.

System Tray alerts can be disabled/hidden by the user.
Also, if the computer goes to sleep (due to Power management) before the shutdown actually occurs, then the countdown will resume after the machine is re-awakened - so the delay is running time not clock time.
For these reasons, setting a delay longer than 10 minutes (600 seconds) is not recommended.

If the computer is manually restarted before the schedule set with Shutdown.exe, the scheduled shutdown will be aborted.

If two shutdown commands are issued against the same computer, the first command will run and the second will fail with errorlevel 1190. If you need to make a change, abort the first command with shutdown /a

Event Log

Shutdown.exe will record events in the Windows SYSTEM Event log with a Source=User32

The event log is the only way to tell that a reboot triggered from Shutdown.exe is pending. It also records the username and date/time when the shutdown command was issued.

When using Shutdown.exe to reboot a server, the shutdown process will normally allow 30 seconds to ensure each running service has time to stop. Services are shutdown in alphabetical order. Halting the services manually in a specific order with NET STOP or SC can be slightly faster.

Reason codes

E = Expected
 U = Unexpected 0x00000000
   P = Planned 0x80000000
   C = customer defined 0x40000000

Type    Major Minor Title
 U      0     0   Other (Unplanned)
E       0     0   Other (Unplanned)
E P     0     0   Other (Planned)
 U      0     5   Other Failure: System Unresponsive
E       1     1   Hardware: Maintenance (Unplanned)
E P     1     1   Hardware: Maintenance (Planned)
E       1     2   Hardware: Installation (Unplanned)
E P     1     2   Hardware: Installation (Planned)
  P     2     3   Operating System: Upgrade (Planned)
E       2     4   Operating System: Reconfiguration (Unplanned)
E P     2     4   Operating System: Reconfiguration (Planned)
  P     2     16  Operating System: Service pack (Planned)
        2     17  Operating System: Hot fix (Unplanned)
  P     2     17  Operating System: Hot fix (Planned)
        2     18  Operating System: Security fix (Unplanned)
  P     2     18  Operating System: Security fix (Planned)
E       4     1   Application: Maintenance (Unplanned)
E P     4     1   Application: Maintenance (Planned)
E P     4     2   Application: Installation (Planned)
E       4     5   Application: Unresponsive
E       4     6   Application: Unstable
 U      5     15  System Failure: Stop error
E       5     19  Security issue
 U      5     19  Security issue
E P     5     19  Security issue
E       5     20  Loss of network connectivity (Unplanned)
 U      6     11  Power Failure: Cord Unplugged
 U      6     12  Power Failure: Environment
  P     7     0   Legacy API shutdown

The reason codes logged in the event log are standard Windows System Shutdown Reason Codes (in Hex)


Shutdown the local system immediately:

SHUTDOWN.exe /s /f

Restart the local system in 60 seconds time and specify the reason "Application: Installation (Planned)" :

SHUTDOWN.exe /r /f /t 60 /d P:4:2

Restart the remote system server64 and specify the reason "Security Fix, Planned"

SHUTDOWN.exe /r /f /m \\server64 /d P:2:17

Using PowerShell, remotely restart a list of computers from a text file of computer names.

$msg = "Due to network maintenance, this computer must be restarted. You have 5 minutes to save your work"
$delay = 300  # seconds
$computers = get-content E:\work\MachineNames.txt
foreach ($computer in $computers)
   & 'C:\Windows\System32\SHUTDOWN.exe' "-m \\$computer -r -c $msg -t $delay"

“I shall go the way of the open sea, To the lands I knew before you came,
And the cool ocean breezes shall blow from me, The memory of your name” ~ Laurence Hope


LOGOFF - Log off a user.
BootCFG - Edit Boot.ini settings.
PsShutdown - SysInternals command line tool
SCHTASKS - Schedule a command to run at a specific time
TsShutDn - Terminal Services Shutdown
EVENTCREATE - Add a message to the Windows event log
$os = (Get-WmiObject Win32_OperatingSystem -ComputerName MyServer64)
$os.psbase.Scope.Options.EnablePrivileges = $true

Copyright © 1999-2017
Some rights reserved