Windows 11 Won't Shut Down? Fast Startup, Hung Apps, Wake Devices, Fixed
—
Windows 11 or 10 won't shut down, hangs on "Shutting down…", turns itself back on, or restarts instead of powering off, and in almost every case the machine is doing exactly what one setting or one driver told it to. The three usual suspects are Fast Startup (which makes "shut down" a partial hibernate that some drivers can't finish), a program or service refusing to close (Windows waits for it, then waits some more), and a device or scheduled task allowed to wake the PC (which makes a finished shutdown look like it never happened). This guide gives the quick fixes in the order that resolves the most machines, the two Event Viewer entries that tell you exactly what happened, the shutdown and powercfg commands that bypass the problem, and, for anyone looking after an office, the Group Policy and Intune settings that stop the "my PC won't turn off" tickets at the source.
The counter PC that took twenty minutes to say goodnight
Jake's shop closes at seven. The counter PC, the one that prints receipts and runs the till software, started sitting on "Shutting down…" for twenty minutes every evening, blue screen, spinning dots, fan running. Jake did what anyone does: he held the power button. It worked. Then one morning the till software said its database was "recovering", and he stopped holding the button and started leaving the PC on overnight instead.
"Twenty minutes isn't a hang," Ethan said. "A hang is forever. Twenty minutes is Windows waiting for something, giving up, and then finishing. It'll have written down what it waited for."
Event Viewer, System log, five minutes later: every evening at 19:02, event 1074 (user initiated shutdown), then a run of Application hang entries for the receipt printer's status utility, then event 6006 at 19:2x. The printer utility was refusing to close; Windows waited its full timeout for it; and because Fast Startup was on, the "shutdown" was actually a hibernate that the printer driver couldn't complete cleanly either.
Two changes: Fast Startup off, and the printer utility removed from startup (it did nothing the driver didn't). Shutdown took nine seconds the next evening. The database "recovering" message had been the power button, not the PC.
That is the shape of this page: what to do tonight, what Windows already wrote down about it, and the settings that made it happen.
Stuck on "Shutting down…" right now: what's safe to do
- Wait five minutes, ten if the screen says anything about updates. A cumulative update finishing its install can hold the shutdown screen for a long time, and interrupting that is the one case that can genuinely hurt (it's how machines end up needing SFC and DISM, or a rollback).
- Look for a hidden dialog. Press Alt+Tab or Win+D: an app asking "save changes?" behind the shutdown overlay stops everything. Answer it.
- Then hold the power button for ten seconds. By the time you see "Shutting down…", every program has been told to close and your files were already saved or you were already asked. The risk of holding the button at that screen is a dirty filesystem journal (fixed automatically on the next boot), not lost documents. Do it, and note the time; you'll use it in Event Viewer.
- Next morning, don't ignore it. A PC that needed the button once will need it again; the fixes below take ten minutes.
Fix 1: Turn off Fast Startup (the cause of most repeat offenders)
What it is. With Fast Startup on (the default on most PCs), "Shut down" doesn't fully shut down. Windows closes your session, then hibernates the kernel and drivers to hiberfil.sys, so the next boot is faster. "Restart", oddly, does do a full shutdown. That's why so many problems (a driver that won't hibernate, a dock that misbehaves, a disk that's still "in use" from a dual-boot Linux) show up on shut down and not on restart. Our Fast Startup guide covers the trade-offs; for shutdown trouble, the trade is easy.
Turn it off: Win+R → powercfg.cpl → Choose what the power buttons do (left) → Change settings that are currently unavailable → clear Turn on fast startup (recommended) → Save changes. From a terminal (elevated), the same thing:
powercfg /hibernate offThat disables hibernation entirely (Fast Startup depends on it) and deletes hiberfil.sys, which also frees several gigabytes. If you use Hibernate deliberately, keep it and instead clear only the Fast Startup box, or set the registry value HiberbootEnabled to 0 under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power (that's exactly what the checkbox does). If the option is missing or grayed out, a policy controls it: see the admin section, or the managed-by-your-administrator guide for the home-PC version of that problem.
Test: shut down normally. If it now completes in seconds, you're done; leave Fast Startup off. Boot takes a few seconds longer on a hard disk and no noticeable time on an SSD.
Fix 2: Find the program or service Windows is waiting for
Windows gives each app a few seconds to close, and each service a timeout (20 seconds by default, longer for some), before ending it. A misbehaving one stretches the shutdown; several stack up.
See it happen. Before you shut down, open Task Manager → Startup apps (Windows 11) or Startup tab (Windows 10): anything with a high Startup impact that you don't need (printer status tools, vendor updaters, RGB lighting software, cloud-sync clients you don't use) is a candidate. Disable them, shut down, and see whether the time drops. The Task Manager guide covers every way in.
Read it from the log. After a slow shutdown, Event Viewer → Windows Logs → Application, sorted by time around the shutdown: Application Hang (ID 1002) names the executable that didn't respond. Windows Logs → System: Service Control Manager entries around the same time name a service that didn't stop in time.
The two registry values people change, honestly assessed. HKCU\Control Panel\Desktop\AutoEndTasks = 1 makes Windows end hung apps without waiting, and WaitToKillAppTimeout / HKLM\SYSTEM\CurrentControlSet\Control\WaitToKillServiceTimeout shorten the waits (values in milliseconds; 5000 is aggressive, the default is 20000 for services). They make shutdown faster; they don't fix the app that hangs, and AutoEndTasks can discard unsaved work in a program that was genuinely still saving. Use them only after removing the actual offender.
🙋♂️ Jake's Reality Check
"Is it bad to hold the power button? Everyone says it corrupts Windows."
The straight answer: at the "Shutting down…" screen, no; during an update, or while you're still using the PC, yes. By the time that screen appears, your programs have closed and Windows is finishing housekeeping. Cutting power then leaves at worst a filesystem check on the next boot. Cutting power while "Working on updates 30%" is showing, or mid-document, is the case that produces real damage. Jake's "database recovering" message came from holding the button while the till software was still writing, before the screen changed.
Fix 3: It shuts down, then turns itself back on (or restarts instead of shutting down)
Two different faults that look the same from across the room:
It restarts instead of shutting down. Usually a driver or firmware combination with Fast Startup: the hibernate-shutdown fails partway and Windows reboots. Fix 1 clears most of these. If it persists with Fast Startup off, check Automatically restart under Advanced system settings → Startup and Recovery → System failure: clear it, and if the PC now stops on a blue screen instead of restarting, you have a crash at shutdown, and the blue screen guides apply.
It powers off, then wakes. Something is allowed to wake it. In an elevated terminal:
powercfg /devicequery wake_armed
powercfg /lastwake
powercfg /waketimersThe first lists every device with wake rights (typically the mouse, keyboard and network adapter). The second says what woke it last time. The third lists scheduled tasks allowed to wake the PC (Windows Update's own maintenance task is a common one). Fixes, in order: Device Manager → the adapter or mouse → Properties → Power Management → clear Allow this device to wake the computer (for a network adapter also clear Wake on Magic Packet unless you use Wake-on-LAN); Task Scheduler → the task → Conditions → clear Wake the computer to run this task; and in the plan's advanced settings, Sleep → Allow wake timers → Disable. On desktops, a BIOS/UEFI setting called ErP, Deep Sleep or Wake on LAN from S5 decides whether the machine can wake from a full shutdown at all; enabling ErP (or disabling the wake options) ends it for good.
The power plans guide covers the same powercfg diagnostics for sleep problems, which share most of this list.
Read what Windows wrote down: the four Event IDs
Event Viewer (Win+R → eventvwr.msc) → Windows Logs → System → Filter Current Log → enter the IDs 41,1074,6005,6006,6008 and the time range of the shutdown that went wrong.
| Event ID | Source | What it tells you |
|---|---|---|
| 1074 | User32 | Who or what asked for the shutdown, at what time, and the reason: a user, Windows Update, an app (shutdown.exe, a management tool). If a shutdown you didn't ask for shows up here, this line names the culprit |
| 6006 | EventLog | The event log service stopped: a clean shutdown completed at this time. The gap between 1074 and 6006 is how long the shutdown actually took |
| 6008 | EventLog | The previous shutdown was unexpected: power was cut (the button, a power failure) before Windows finished. One per button-press |
| 41 | Kernel-Power | The system rebooted without cleanly shutting down first: a crash, a power loss, or a hard reset. Pairs with 6008 |
| 6005 | EventLog | Event log started: the next boot. Useful as the end marker |
Two patterns worth recognizing: 1074 then a long gap then 6006 means Windows waited for something (Fix 2); 1074 then 41/6008 with no 6006 means the shutdown never completed and someone hit the button. 41 with no 1074 before it means nobody asked: a crash or a power cut. Kernel-Power 41 with BugcheckCode other than 0 is a blue screen; look in Reliability Monitor (perfmon /rel) for the matching crash entry.
The shutdown commands (and the ones for remote PCs)
| Command | What it does |
|---|---|
shutdown /s /t 0 | Shut down now, normally (respects Fast Startup) |
shutdown /s /f /t 0 | Shut down now, forcing apps closed without waiting; the fix for a PC that hangs on a stubborn program |
shutdown /s /hybrid /t 0 | Shut down using Fast Startup explicitly |
shutdown /r /t 0 | Restart (always a full shutdown) |
shutdown /r /o /t 0 | Restart into the recovery menu (WinRE) |
shutdown /p | Immediate power-off, no timeout, no warning (like the button, but clean) |
shutdown /a | Abort a pending timed shutdown |
shutdown /s /m \\PC-NAME /t 0 /c "closing time" | Shut down another PC on the network (needs admin rights there and the Remote Registry / RPC ports open) |
Stop-Computer -ComputerName PC1,PC2 -Force | The PowerShell version, over WinRM (what an admin actually uses; see below) |
If shutdown /s hangs but shutdown /s /f works, you've confirmed Fix 2: an app is refusing to close. If both hang, it's a driver or service, and Fix 1 plus the Event Viewer entries point at it. Our shut down without installing updates guide covers the "Update and shut down" menu when that's the thing you're avoiding.
Fix 4: The driver, the dock, and the other hardware causes
When Fast Startup is off, no app is hanging and the events show a long gap anyway, the remaining causes are hardware-side:
- Docks and USB devices. Unplug the dock, external drives and USB hubs, shut down. If it's now quick, add them back one at a time. USB selective suspend and some dock firmware are the usual pair. - Storage drivers. Intel RST/VMD or a third-party NVMe driver that doesn't handle the power transition; update from the maker's page, or switch to the Microsoft driver. - Graphics driver. A display driver that fails to unload shows as a long gap with nothing in the Application log. Clean-install the GPU driver. - Intel Management Engine / chipset drivers on laptops: a stale ME driver is a known cause of restart-instead-of-shutdown. Update chipset and ME from the laptop maker. - Dual boot with Linux. With Fast Startup on, the Windows disk is left in a hibernated state and Linux mounts it read-only; with it off, both behave. This one really is Fix 1. - Firmware. An old BIOS/UEFI with ACPI bugs. Check the version (how) and update if the maker's notes mention power or shutdown.
powercfg /energy (elevated, 60 seconds) writes a report that names drivers and devices with power-management errors, which is the fastest way to find which of these it is.
For IT admins: stop the shutdown tickets at the source
Group Policy (Computer Configuration → Administrative Templates → System): - Shutdown → Require use of fast startup: set Disabled to turn Fast Startup off everywhere (Enabled forces it on; Not Configured leaves the user's checkbox). Disabled is the right default for a managed fleet with docks, imaging tools or dual-boot lab machines. - Power Management → Sleep Settings → Allow wake timers: Disabled stops scheduled tasks waking shut-down PCs (leave Wake-on-LAN handled separately in the NIC driver). - Scripts → Specify maximum wait time for Group Policy scripts: shutdown scripts hang shutdowns; the default cap is 600 seconds. Set it to 60 and fix the script. - Logon → Turn off Windows Startup sound / Shutdown Event Tracker: the Display Shutdown Event Tracker policy (usually servers) adds the "why are you shutting down?" prompt; turn it off on workstations if someone enabled it.
Intune (Settings catalog): search fast startup → Require use of fast startup (set Disabled); Power → Allow standby states, wake timers and the lid/button actions; and Local Policies Security Options → Shutdown: Allow system to be shut down without having to log on if you need the sign-in-screen power button.
Remote shutdown and audit, one line each. Shut down a list of PCs at closing time: Stop-Computer -ComputerName (Get-Content C:\temp\pcs.txt) -Force (WinRM must be enabled, the same as for the inventory script). Find the machines that were hard-powered-off this week:
Invoke-Command -ComputerName (Get-Content C:\temp\pcs.txt) -ScriptBlock {
$e = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6008,41; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
[pscustomobject]@{ PC = $env:COMPUTERNAME; UncleanShutdowns = @($e).Count; Last = ($e | Select-Object -First 1).TimeCreated }
} | Sort-Object UncleanShutdowns -DescendingA PC with five unclean shutdowns in a week is a PC someone is holding the button on every evening. That list is your ticket queue before the tickets arrive.
✅ The admin's version in one line
Disable Fast Startup by policy on managed machines, cap script timeouts, deny wake timers, and count 6008/41 events weekly. The shutdown problem is almost never a mystery; it's one of four settings and a driver.
Shutdown problems: the fix table
| What you see | What it usually means | What to do |
|---|---|---|
| Hangs on "Shutting down…" every time | Fast Startup + a driver, or a hung app | Turn Fast Startup off; check Application log ID 1002 |
| Hangs only sometimes | An app that occasionally refuses to close | shutdown /s /f; find it in the Application log; remove it from startup |
| "Restart" works, "Shut down" doesn't | Fast Startup (shutdown is a hibernate; restart isn't) | Fix 1 |
| Restarts instead of shutting down | Failed hibernate-shutdown, or a crash at shutdown | Fix 1; clear Automatically restart; check Kernel-Power 41 |
| Turns back on after shutdown | A wake-armed device or a wake timer | powercfg /lastwake; Device Manager → Power Management; disable wake timers; ErP in BIOS |
| "Shutting down…" with the update message for a long time | Update finishing | Wait; do not cut power |
| Screen goes black, fans stay on | Display driver unloaded, shutdown still running | Wait two minutes; if it repeats, update or clean-install the GPU driver |
| Shut down from the Start menu does nothing | Explorer or the shell hung | shutdown /s /f /t 0 from Ctrl+Shift+Esc → Run new task |
| Fast Startup checkbox missing | Hibernation disabled, or a policy | powercfg /hibernate on; check gpresult /r |
| Laptop shuts down when the lid closes instead of sleeping | Lid action set to Shut down | Power Options → Choose what closing the lid does |
| "Windows can't shut down while updates are being installed" | Pending update | Let it finish, or use shut down without installing updates |
| Sign-in screen has no power button | Policy or a registry tweak | Local Security Policy → Shutdown: Allow system to be shut down without having to log on |
Windows won't shut down: the questions people search
Why won't my Windows 11 PC shut down?
Most often Fast Startup: "Shut down" hibernates the kernel and a driver fails to complete it. Second, a program or service refusing to close, which Windows waits for. Third, a device or task allowed to wake the PC, which makes a finished shutdown look like it failed. Turn Fast Startup off first.
How do I force Windows 11 to shut down?
Hold the power button for ten seconds at the "Shutting down…" screen, or from a terminal run shutdown /s /f /t 0, which closes programs without waiting. shutdown /p powers off immediately.
Is it safe to hold the power button to shut down?
At the "Shutting down…" screen, yes: programs have already closed and your work was saved or you were asked. During an update or while apps are open, no; that's when data loss and corruption happen.
Why does my PC restart instead of shutting down?
Usually a failed Fast Startup hibernate, or a crash at shutdown with Automatically restart enabled. Turn Fast Startup off; if it persists, clear Automatically restart under Startup and Recovery and check Event Viewer for Kernel-Power 41.
Why does my computer turn back on after I shut it down?
A device with wake rights (network adapter, mouse, keyboard) or a scheduled task with "wake the computer". Run powercfg /lastwake to see what woke it, then disable that device's wake permission in Device Manager or the task's wake condition; disable wake timers in the power plan; enable ErP in the BIOS on desktops.
How do I turn off Fast Startup in Windows 11?
Win+R → powercfg.cpl → Choose what the power buttons do → Change settings that are currently unavailable → clear Turn on fast startup → Save. Or run powercfg /hibernate off in an elevated terminal, which disables hibernation and Fast Startup together.
What is Event ID 6008?
"The previous system shutdown was unexpected": Windows didn't finish shutting down before power was lost, which is what a held power button, a power cut or a crash leaves behind. Event 41 (Kernel-Power) appears alongside it.
How do I see what caused a shutdown?
Event Viewer → Windows Logs → System → filter for Event ID 1074: it records who or what requested the shutdown, when, and the reason. 6006 marks a clean completion; the time between them is how long it took.
Why does shutdown take so long in Windows 11?
Windows waits for apps and services to close (about 20 seconds each by default) and, with Fast Startup, writes the hibernation file. A slow shutdown is usually one hung app (Application log, ID 1002) or Fast Startup on a PC with a driver that hibernates badly.
Does the AutoEndTasks registry tweak fix slow shutdown?
It makes Windows end hung programs without waiting, so shutdown gets faster, but it can discard unsaved work from a program that was still saving. Remove the hanging program instead; use the tweak only as a last resort.
How do I shut down a remote computer?
shutdown /s /m \\PC-NAME /t 0 with admin rights on the target, or in PowerShell Stop-Computer -ComputerName PC-NAME -Force over WinRM. For many machines, pass a list to -ComputerName.
Why won't my PC shut down after a Windows update?
The update is still installing in the shutdown phase; interrupting it is the one case that causes real damage. Wait, even if it takes twenty minutes. If it's stuck for over an hour with no disk activity, hold the button and run SFC and DISM afterwards.
Can Group Policy stop Fast Startup on all PCs?
Yes: Computer Configuration → Administrative Templates → System → Shutdown → Require use of fast startup → Disabled turns it off on every managed machine. The same setting exists in Intune's settings catalog.
How do I find which app is blocking shutdown?
Event Viewer → Windows Logs → Application, at the shutdown time: Application Hang (ID 1002) names it. Before shutting down, powercfg /requests shows processes holding power requests, which are often the same ones.
Why does my laptop shut down when I close the lid?
The lid action is set to Shut down. Power Options → Choose what closing the lid does → set Sleep or Do nothing, for on battery and plugged in separately.
Is there a difference between shut down and restart in Windows 11?
Yes. With Fast Startup on, Shut down hibernates the kernel for a faster boot; Restart performs a full shutdown and cold boot. That's why "turn it off and on again" sometimes only works with Restart.
Does Windows 10 behave the same?
Yes. Fast Startup, the shutdown command switches, the Event IDs and the wake diagnostics are identical on Windows 10; only the Settings layout differs.
If you've been holding the power button every night and feeling slightly guilty about it, stop feeling guilty and start reading the log: the PC has been writing down what it was waiting for the whole time. Turn Fast Startup off, remove the one program that never closes, and shutting down goes back to being the least interesting thing your computer does. If a screen here has moved by the time you read it, tell me through the contact page; Windows changes these settings between versions, and this page stays accurate because readers write in.
📌 If you keep one line from this page
Turn Fast Startup off first; then find the app Windows waits for (Application log, ID 1002); then check what's allowed to wake the PC (powercfg /lastwake).
Event 1074 says who asked for the shutdown, 6006 says it finished cleanly, 6008 and 41 say someone cut the power.
Revision note. Originally published November 2016 for Windows 10; rewritten September 26, 2026, for Windows 11 25H2 and Windows 10, with the Fast Startup explanation, the Event Viewer method, the powercfg wake diagnostics and the Group Policy and Intune section added. Commands and event IDs are current as of that date. Next check: when Windows changes the power-button settings page or the shutdown switches. Fast Startup off, then the log.