There are a lot of things happening during the shutdown process. Here are just a few examples:
• Checking to see if any user applications have not been closed yet (like an unsaved document) and prompt the user if necessary
• Stopping background services
• Waiting for the termination signal from services and applications that are open or running
• Flushing the cache to disk
• Writing log files
• All users are logged out
• Ending the shell
• Start installing Windows updates and tell the system to finish the update process during the next system start-up if necessary
• Send the ACPI shutdown signal (this is what turns the machine off)
► ACPI shutdown is a signal sent to the OS by an ACPI compliant chipset, e.g. when you push the PCs power button. Alternatively, it is the OS shutdown triggered by the receipt of that signal
Here is an excerpt from a document that Microsoft released:
• System session shutdown. This phase includes the pre-shutdown notification and shutdown notification sub-phases.
• Pre-shutdown notification. Windows serially shuts down all services that registered to receive pre-shutdown notifications. Ordered services—services that have set up the shutdown order of dependent services—are shut down before non-ordered services.
• Shutdown notification. All services that registered to receive shutdown notifications are shut down in parallel. If all services have not exited after 20 seconds (in Windows Vista) or 12 seconds (in Windows 7 client operating systems), the system continues the shutdown. Processes and services that do not shut down in a timely manner are left running as the system shuts down.
• Kernel shutdown. The remainder of the system, such as all devices and drivers, are shut down during the kernel shutdown phase.
Basically, what you are waiting on is each individual service to clean up and exit. Each service is given 12 seconds to exit before it is killed.
Half of the shutdown time is dedicated to shutting down system services. If you are really interesting in seeing what time is dedicated to whatever during a shutdown, Windows includes a tool for tracing shutdown time.
• xbootmgr -trace shutdown -numRuns 3 -resultPath %systemdrive%\traces -postBootDelay 180 -traceFlags base
And to make sense of the generated file (be sure to run in %systemdrive%\traces)
• xperf -i trace.etl -o summary.xml -a shutdown
Sources
Windows On/Off Transition Performance Analysis Document [Microsoft]
Windows On/Off Transitions Solutions Guide Document [Microsoft]
htg
