SHUTDOWN.exe – Windows CMD Command

Shutdown the computer

Alert Messages to logged in users

Shutdown will display one or two alert messages to the user depending on the delay (set with /t) as follows:

< 3 minutes – A custom popup alert appears immediately (default).
>=3 mins and <=10 mins – A custom popup alert immediately and then a generic popup alert 2 mins before shutdown.
> 10 mins and < 11 mins – A system tray alert (with custom message) appears immediately, and then nothing else.
>=11 mins – A system tray alert (with custom message) appears immediately, and then a generic popup alert 10 mins before shutdown.

System Tray alerts can be disabled/hidden by the user.
Also, if the computer goes to sleep (due to Power management) before the shutdown actually occurs, then the countdown will resume after the machine is re-awakened – so the delay is running time not clock time.
For these reasons, setting a delay longer than 10 minutes (600 seconds) is not recommended.

If the computer is manually restarted before the schedule set with Shutdown.exe, the scheduled shutdown will be cancelled.

If two shutdown commands are issued against the same computer, the first command will run and the second will fail with errorlevel 1190. If you need to make a change, cancel the first command with shutdown /a

Restarting Registered Applications

The Windows Restart Manager, introduced in Windows Vista, supports restarting applications after a system shutdown if they have been registered for restart with the RegisterApplicationRestart API.
If the application is forcefully shutdown, (not a standard gracefull termination) then the Restart Manager will not attempt to restart the application.

This functionality is used by Windows Update, Microsoft Office, IE/Edge, Visual Studio, and many other recent applications

Event Log

Just before the computer is shutdown, shutdown.exe will record the shutdown event in the Windows SYSTEM Event log with a Source=User32 and event ID 1074 along with any custom message & reason code.

The event log is the only way to tell that a reboot triggered from Shutdown.exe is pending. It also records the username and date/time when the shutdown command was issued.

When using Shutdown.exe to reboot a server, the shutdown process will normally allow 30 seconds to ensure each running service has time to stop. Services are shutdown in alphabetical order. Halting the services manually in a specific order with NET STOP or SC can be slightly faster.

Reason codes

The reason codes, specified with /d are logged in the Windows System Event Log as System Shutdown Reason Codes (in Hex).

Shutdown.exe will also accept options prefixed with dashes instead of forward slashes: -s -f etc


Shutdown the local system in one second from now:

SHUTDOWN.exe /s /f /t 1

Restart the remote system server64 in 60 seconds time and specify the reason “Application: Installation (Planned)” [0x80040002]:

SHUTDOWN.exe /r /f /m \\Server64 /t 60 /d P:4:2

To shut down the local machine in 30 seconds time, force running applications to close, restart the computer after shutdown, indicate a user code, indicate that the shutdown is planned, log major/minor reason codes and a comment:

shutdown /r /f /c "Demo of Shutdown" /d up:125:1

Restart the remote system server64 and specify the reason “Security Fix, Planned”

shutdown /r /f /m \\server64 /d P:2:17

Using PowerShell, remotely restart a list of computers from a text file of computer names.

You may also like...

1 Response

  1. zortilonrel says:

    F*ckin’ amazing issues here. I am very satisfied to see your post. Thank you so much and i am taking a look ahead to contact you. Will you please drop me a mail?

Leave a Reply

Your email address will not be published. Required fields are marked *