shutdown — Shutdown, Restart, and Logoff

What it is

shutdown is a built-in Windows command for initiating or cancelling a system shutdown, restart, or logoff — locally or on a remote machine. It supports timed delays with a visible warning dialog, forced closing of running applications, hibernation, and hybrid (fast) startup. Administrators use it to schedule maintenance reboots, push patch restarts to remote machines, and automate post-deployment restarts in scripts. The PowerShell equivalents are Stop-Computer, Restart-Computer, and shutdown.exe (called directly).

Availability

shutdown ships as C:\Windows\System32\shutdown.exe on all Windows versions. Remote shutdown requires Administrator privileges on the target machine and the Remote Shutdown firewall rule to be enabled.

shutdown /?

Output:

Usage: shutdown [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/soft]
               [/fw] [/f] [/m \\computer] [/t xxx] [/d [p|u:]xx:yy] [/c "comment"]

No args    Display help. This is the same as typing /?.
/?         Display help. This is the same as typing with no args.
/i         Display the graphical user interface (GUI). This must be the first option.
/l         Log off. This cannot be used with /m or /d option.
/s         Shutdown the computer.
/sg        Shutdown the computer. On the next boot, if Automatic Restart Sign-On
           is enabled, automatically sign in and lock last interactive user.
/r         Full shutdown and restart the computer.
/g         Full shutdown and restart the computer. After the system is rebooted,
           if Automatic Restart Sign-On is enabled, automatically sign in and
           lock last interactive user.
/a         Abort a system shutdown.
/p         Turn off the local computer with no time-out or warning.
/h         Hibernate the local computer.
/hybrid    Performs a shutdown of the computer and prepares it for fast startup.
/fw        Combine with a shutdown option to cause the next boot to go to the
           firmware user interface.
/e         Document the reason for an unexpected shutdown of a computer.
/o         Go to the advanced boot options menu and restart the computer.
           Must be used with /r option.
/m \\computer  Specify the target computer.
/t xxx     Set the time-out period before shutdown to xxx seconds.
           The valid range is 0-315360000 (10 years), with a default of 30.
/c "comment"  Comment on the reason for restart or shutdown.
/f         Force running applications to close without warning users.
/d [p|u:]xx:yy  Provide the reason for the restart or shutdown.

Syntax

shutdown [/s | /r | /l | /h | /a | /p] [/m \\computer] [/t seconds] [/f] [/c "comment"] [/d code]

Output: (none — action is initiated; dialog appears for timed shutdowns)

Essential options

Immediate shutdown

/s /t 0 shuts down the machine immediately with no delay or dialog. Always combine with /f in scripts to prevent hung applications from blocking the shutdown.

shutdown /s /t 0 /f

Output:

(none — system begins shutdown immediately)

Immediate restart

/r /t 0 reboots the machine immediately. The most common use in post-patch scripts.

shutdown /r /t 0

Output:

(none — system begins restart immediately)

Timed restart with a message

Setting /t to a positive value triggers the Windows shutdown dialog showing a countdown and the /c comment. This gives interactive users time to save their work.

shutdown /r /t 300 /c "System restart for security patch KB1234567. Save your work." /f

Output:

(none — Windows displays a shutdown dialog with 5-minute countdown)

Aborting a pending shutdown

/a cancels a timed shutdown that hasn't triggered yet. Useful if a patch rollout needs to be halted mid-flight.

shutdown /a

Output:

(none — exits 0 if a shutdown was pending and was cancelled)

Remote shutdown

/m \\hostname targets a remote machine. Requires the target to have the Remote Shutdown firewall exception enabled and the invoking user to have admin rights on the remote machine.

shutdown /r /m \\fileserver01 /t 60 /c "Scheduled maintenance restart" /f

Output:

(none — remote machine begins its countdown)

Log off the current user

/l ends the current user's session without affecting other logged-on users. Cannot be combined with /m — only applies to the local interactive session.

shutdown /l

Output:

(none — current session ends)

Hibernate

/h saves the complete memory state to disk and powers off the machine. On resume, Windows restores the exact desktop state. Requires hibernate to be enabled (powercfg /h on).

shutdown /h

Output:

(none — system hibernates)

Common pitfalls

1. /t 0 bypasses the abort window — once shutdown /r /t 0 /f is issued, there is no time to run shutdown /a; always use a short delay (e.g. /t 30) if there's any chance you may need to cancel.
2. /f can cause data loss — forced close kills apps without giving them a chance to save; only use /f in scripts where all user data has already been saved or in headless server scenarios.
3. Remote shutdown requires firewall rule — shutdown /m \\host fails with Access is denied if the target's Windows Firewall blocks the Remote Shutdown exception; enable it via netsh advfirewall firewall set rule group="Remote Shutdown" new enable=yes on the target.
4. /l cannot be used remotely — logoff only works on the local session; use quser/logoff for remote session termination.
5. /h may be disabled by policy — if hibernate is disabled via powercfg /h off or Group Policy, shutdown /h returns error 1115.

Real-world recipes

Post-patch reboot script with audit trail

@echo off
echo %DATE% %TIME% - Initiating post-patch reboot on %COMPUTERNAME% >> C:\Logs\reboot.log
shutdown /r /t 60 /c "Post-patch reboot: monthly security updates applied" /d p:4:2 /f

Output:

(none — Windows shows reboot dialog; log entry written)

Restart a list of remote servers

@echo off
for %%S in (webserver01 webserver02 appserver01) do (
    shutdown /r /m \\%%S /t 30 /f /c "Scheduled restart" >NUL 2>&1
    if %errorlevel%==0 (
        echo Restart initiated: %%S
    ) else (
        echo FAILED: %%S
    )
)

Output:

Restart initiated: webserver01
Restart initiated: webserver02
Restart initiated: appserver01

Cancel a mistaken shutdown within the grace period

rem Issued by mistake — cancel immediately
shutdown /a
echo Shutdown aborted.

Output:

Shutdown aborted.

Reason codes (/d)

/d records why the shutdown happened so administrators can mine the System event log later — every value writes to event ID 1074 (User32) with a structured reason. The format is [p|u]:major:minor where p marks a planned event and u an unplanned one. Use planned codes (p:) for patch reboots, deployments, and scheduled maintenance, and unplanned codes (u:) when documenting a crash or unexpected restart triggered manually.

shutdown /r /t 60 /d p:4:2 /c "Monthly cumulative update reboot"

Output:

(none — Windows displays a 60-second restart dialog; Event 1074 is logged with reason p:4:2)

Browse all known reason codes:

shutdown /?

Output:

Usage: shutdown [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/soft] [/fw] [/f]
    [/m \\computer][/t xxx][/d [p|u:]xx:yy [/c "comment"]]

No args displays help. See /? for the full reason code list at the end.

The most common codes — every flag mapping is in HKLM\Software\Microsoft\Windows\CurrentVersion\Reliability\UserDefined:

After the reboot, find the event that records the reason in the System log:

Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 1074 } -MaxEvents 5 |
    Format-Table TimeCreated, @{N='User';E={$_.Properties[6].Value}}, @{N='Reason';E={$_.Properties[2].Value}} -Wrap

Output:

TimeCreated            User              Reason
-----------            ----              ------
5/24/2026 8:15:02 AM   CORP\alicedev     Operating System: Service pack (Planned)

Documenting an unexpected shutdown (/e)

/e is a documentation-only flag. After Windows boots from a crash or sudden power-down it shows the Shutdown Event Tracker on the next admin login asking for a reason; /e lets you populate that reason from the command line without waiting for the GUI dialog. The result lands in event log 1076 (the dual of 1074), which is what compliance scripts grep for in regulated environments.

shutdown /e /m \\fileserver01 /c "Power-supply replacement, scheduled change CHG-1234" /d u:1:1

Output:

(none — event 1076 is written to the remote host's System log)

Reboot to firmware (/fw) and recovery (/o)

/fw schedules the next reboot to land in UEFI firmware setup instead of Windows — equivalent to mashing F2/Del at the boot screen but from a remote terminal. /o reboots into the Advanced startup options menu (Safe Mode, Startup Settings, USB recovery, etc.). Both must be combined with /r.

shutdown /r /fw /t 0

Output:

(none — system restarts directly into UEFI firmware)

shutdown /r /o /f /t 0

Output:

(none — system restarts into the WinRE recovery menu)

/fw is gold for headless servers: you can re-enable Secure Boot, toggle virtualization, or switch boot order over a remote session without physical access.

Hybrid shutdown (/hybrid) vs full shutdown

Windows 8+ ships with Fast Startup enabled by default — a regular /s shutdown is actually /s /hybrid, which hibernates the kernel session to hiberfil.sys so the next cold boot loads from disk in seconds. That convenience comes with a trap for support staff: drivers and kernel state are not fully reinitialized, so a "real" reboot to clear a misbehaving driver requires explicit options.

rem Fast-startup-friendly shutdown (Windows 8+ default behaviour)
shutdown /s /hybrid /t 0

rem Full (cold) shutdown — no kernel hibernation, drivers fully reload
shutdown /s /t 0

Output: (none — system shuts down immediately)

Confirm whether Fast Startup is on:

powercfg /a

Output:

The following sleep states are available on this system:
    Standby (S3)
    Hibernate
    Fast Startup

The following sleep states are not available on this system:
    ...

Disable Fast Startup permanently so every shutdown /s is a cold one:

powercfg /h off

Output: (none — exits 0 on success)

Auto sign-in modes (/sg and /g)

/sg (shutdown then sign-in on next boot) and /g (restart then sign-in) are Automatic Restart Sign-On (ARSO) flags. When ARSO is enabled by policy, these flags re-sign the previously logged-in user automatically on the next boot, then lock the workstation, so any apps that were running before the reboot can relaunch from autostart with the user's profile already loaded. They're useful for unattended patch reboots that need user-context services to come back up.

shutdown /g /t 30 /c "Reboot for monthly patch; ARSO will re-launch your apps."

Output:

(none — Windows displays the 30-second restart dialog)

Verify ARSO is enabled:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DisableAutomaticRestartSignOn"

The graphical /i dialog

shutdown /i opens the GUI Remote Shutdown Dialog — a small dialog where you type a list of computer names, pick the action (shutdown/restart/annotate), set the warning duration, and pick a reason from a dropdown. Useful for ad-hoc small-fleet reboots when you don't want to script anything. /i must be the first argument and ignores all other switches.

shutdown /i

Output:

(opens the Remote Shutdown Dialog GUI; no console output)

The dialog reads the Browse list from Active Directory or NetBIOS browse master, so on a workgroup network you'll need to type names manually.

PowerShell equivalents

PowerShell ships cmdlets that wrap the same kernel APIs as shutdown.exe but return PowerShell objects and accept richer parameter sets. They're the right choice when you're already in a PowerShell session — especially for remoting fleets via -ComputerName arrays.

# Local immediate restart
Restart-Computer -Force

# Local immediate shutdown
Stop-Computer -Force

# Delayed restart (PowerShell has no /t — use Start-Sleep or schtasks)
Start-Sleep -Seconds 60; Restart-Computer -Force

# Restart a fleet, wait for each to come back online
Restart-Computer -ComputerName web01, web02, web03 -Wait -For PowerShell -Timeout 600 -Force

# Use explicit credentials for a workgroup target
Restart-Computer -ComputerName web01 -Credential (Get-Credential) -Force

# Send a custom reason
Restart-Computer -ComputerName web01 -Force `
    -Reason "Hardware: Maintenance (Planned)" `
    -MajorReason 1 -MinorReason 1

Output (Restart-Computer -ComputerName web01, web02, web03 -Wait):

(none — blocks until all three are back, throws if any fail)

Differences from shutdown.exe worth knowing:

For low-level access to the same APIs from PowerShell, the WMI/CIM Win32_OperatingSystem class still works:

(Get-CimInstance Win32_OperatingSystem).Win32Shutdown(2)
# 0 = LogOff, 1 = Shutdown, 2 = Reboot, 4 = Force LogOff,
# 5 = Force Shutdown, 6 = Force Reboot, 8 = Power Off

Scheduling a delayed reboot at a fixed clock time

shutdown /t only takes a relative delay in seconds. For an absolute clock time (e.g. "reboot at 02:00 tonight"), wrap it in schtasks so the task survives across logoffs and matches the maintenance window cleanly.

schtasks /create /tn "NightlyReboot" /tr "shutdown /r /f /t 0" /sc once /st 02:00 /ru SYSTEM

Output:

SUCCESS: The scheduled task "NightlyReboot" has successfully been created.

Delete it once consumed (the task itself only fires once):

schtasks /delete /tn "NightlyReboot" /f

Output:

SUCCESS: The scheduled task "NightlyReboot" was successfully deleted.

Detecting whether a shutdown is already pending

A pending shutdown writes a marker that callers can probe before issuing their own command. The simplest probe runs shutdown /a and inspects the exit code — 0 means a pending shutdown was just aborted; 1116 (ERROR_NO_SHUTDOWN_IN_PROGRESS) means there was nothing to cancel.

shutdown /a >NUL 2>&1
if %errorlevel%==0 (
    echo A shutdown was pending and has been cancelled.
) else (
    echo No shutdown was pending.
)

Output:

No shutdown was pending.

For a non-destructive probe (without actually cancelling), check the registry value that the shutdown engine writes:

Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending"

Output:

True

Exit codes

Knowing what %errorlevel% means after shutdown runs is the difference between a noisy log file and a meaningful one. The most common codes:

Check the active privilege set with whoami /priv | findstr Shutdown — SeShutdownPrivilege must be present and able to be enabled for /s and /r to succeed. See the whoami cheat sheet for full token inspection.

Logging and event-log forensics

Every shutdown invocation that succeeds writes event ID 1074 ("USER32") to the System log, and every reboot writes 6005/6006/6008 from the EventLog source. Pair them to reconstruct a host's reboot history.

Get-WinEvent -FilterHashtable @{ LogName='System'; Id=1074,1076,6005,6006,6008 } -MaxEvents 20 |
    Sort-Object TimeCreated |
    Format-Table TimeCreated, Id, ProviderName, Message -Wrap

Output:

TimeCreated           Id  ProviderName     Message
-----------           --  ------------     -------
5/22/2026 9:14:55 PM 6006 EventLog         The Event log service was stopped.
5/22/2026 9:15:35 PM 6005 EventLog         The Event log service was started.
5/24/2026 8:14:50 AM 1074 User32           The process C:\Windows\System32\shutdown.exe (...

A 6008 with no preceding 1074 indicates a power loss or crash — the absence of the 1074 is the giveaway that the shutdown was not initiated cleanly.

Comparison with related commands

shutdown is the dedicated reboot/poweroff utility, but adjacent commands cover overlapping ground. Pick the right tool for the audit trail you need:

Common scenarios

Restart a Hyper-V guest from the host without RDP

When a Hyper-V VM hangs at the desktop but accepts RPC, shutdown /r /m is the fastest unstick — no console connection needed.

shutdown /r /m \\dev-vm-01 /t 0 /f /c "Stuck UI, remote restart" /d u:5:15

Output:

(none — VM begins restart; event 1074 is logged with reason u:5:15)

Drain and reboot a load-balanced web tier

Drain traffic, wait, then reboot — the canonical patch-rollout script.

@echo off
set HOSTS=web01 web02 web03
for %%H in (%HOSTS%) do (
    echo Draining %%H...
    powershell -Command "Set-NlbClusterNode -InputObject (Get-NlbClusterNode -ComputerName %%H) -StatusUpdate Drain"
    timeout /t 60 >NUL
    shutdown /r /m \\%%H /t 30 /f /c "Patch reboot" /d p:2:17
    timeout /t 300 >NUL
)

Output:

Draining web01...
Draining web02...
Draining web03...

Reboot into firmware to enable VT-x remotely

For a fleet of hosts that need a BIOS change pushed without dispatching a tech:

for /f %%H in (servers.txt) do shutdown /r /fw /m \\%%H /t 60 /c "Enable VT-x"

Output: (none — each host queues a reboot; failures print to stderr)

Hibernate the workstation before leaving the office

shutdown /h

Output: (none — system hibernates immediately)

The desktop state — open browser tabs, running editors, ssh tunnels — is restored verbatim on the next power-on.

Related cheat sheets

• whoami — check SeShutdownPrivilege before scripting reboots
• powershell-basics — Restart-Computer / Stop-Computer cmdlets
• powershell-remoting — fleet-wide command execution
• schtasks — schedule reboots at a fixed clock time
• bcdedit — set Safe Mode boot before shutdown /r
• powercfg — enable/disable hibernate and fast startup
• wevtutil — query the System log for reboot history

Sources

• shutdown | Microsoft Learn — full switch list including /sg, /g, /fw, /hybrid
• Description of Shutdown Event Tracker | Microsoft Learn — reason codes and event 1074 / 1076 semantics
• Restart-Computer | Microsoft Learn — PowerShell cmdlet equivalents with -Wait -For PowerShell
• Stop-Computer | Microsoft Learn — local and remote shutdown via PowerShell