If you are a long-time Neowin reader, chances are you may be amongst those Windows users who had noticed a curious behavior: holding the Shift key while restarting doesn’t trigger a full cold reboot; instead, the system would do something slightly different.
For those not familiar, when a user held down the Shift key while restarting Windows 95, the system behaved differently than during a full cold reboot. Instead of cycling the hardware completely, Windows displayed “Windows is restarting” and attempted what was essentially a fast-restart. In a way, this was kind of like Fast Startup, which Microsoft introduced much later in Windows 8. If you attempt a Shift + Restart on Windows 11 and 10 you get into Windows Recovery Environment (WinRE).
Veteran Microsoft Windows developer Raymond Chen has explained how this worked. Chen, in his newly penned article on his The Old New Thing column, notes that this behavior was part of the old 16‑bit ExitWindows function when it received the EW_RESTARTWINDOWS flag.
If you are wondering, the ExitWindows function is a legacy function used to log off the interactive Windows user, while the EW_RESTARTWINDOWS parameter, as the name suggests, is used to restart the system.
Chen has explained that the shut down sequence began first with the 16‑bit Windows kernel itself, followed by the 32‑bit virtual memory manager, and then the CPU dropping back into real mode.
After this, control returned to the bootstrap program "win.com" with a special signal “Can you start protected mode Windows again for me?” thus instructing it to relaunch protected‑mode Windows. Hence, the code in win.com would then display the “Please wait while Windows restarts…” message as it tried to get the system back up as requested.
If you are trying to make sense of it, Win.com was essentially the executable file used to load different Windows versions based on DOS, like Windows 95. Meanwhile, Real mode Windows is an early design meant to run on PCs with minimal resources, like 192 KB of RAM and floppy drives, and Protected mode Windows is like the full OS version, with memory protection, GUI, and all.
Chen notes that by its nature of design, .com files claimed all conventional memory at launch, but in the case of win.com, it would release unused space to create one large contiguous block for protected‑mode Windows. So if another program had fragmented that memory space, the fast restart could not succeed, and win.com fell back to a full reboot. Otherwise, the fast restart continued as it re‑created the virtual machine manager and launched the graphical user interface (GUI), giving the user the impression of a seamless fast restart.
However, the process was not flawless as Raymond Chen adds, since some users reported that attempting two fast restarts in succession would lead to crashes, while others seemingly managed multiple fast restarts without issue. The likely explanation was that certain device drivers failed to reset properly, leaving corrupted memory that only revealed itself during shutdown.
source
