System Shutdown Reason Codes

The shutdown reason codes are used by the ExitWindowsEx and InitiateSystemShutdownEx functions in the dwReason parameter.

A maximum of MAX_NUM_REASONS reason codes will be processed by the system. MAX_NUM_REASONS is defined in reason.h.

The following are the major reason flags. They indicate the general issue type.

Constant/value Description
SHTDN_REASON_MAJOR_APPLICATION
0x00040000
Application issue.
SHTDN_REASON_MAJOR_HARDWARE
0x00010000
Hardware issue.
SHTDN_REASON_MAJOR_LEGACY_API
0x00070000
The InitiateSystemShutdown function was used instead of InitiateSystemShutdownEx.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM
0x00020000
Operating system issue.
SHTDN_REASON_MAJOR_OTHER
0x00000000
Other issue.
SHTDN_REASON_MAJOR_POWER
0x00060000
Power failure.
SHTDN_REASON_MAJOR_SOFTWARE
0x00030000
Software issue.
SHTDN_REASON_MAJOR_SYSTEM
0x00050000
System failure.

The following are the minor reason flags. They modify the specified major reason flag. You can use any minor reason in conjunction with any major reason, but some combinations do not make sense.

Constant/value Description
SHTDN_REASON_MINOR_BLUESCREEN
0x0000000F
Blue screen crash event.
SHTDN_REASON_MINOR_CORDUNPLUGGED
0x0000000b
Unplugged.
SHTDN_REASON_MINOR_DISK
0x00000007
Disk.
SHTDN_REASON_MINOR_ENVIRONMENT
0x0000000c
Environment.
SHTDN_REASON_MINOR_HARDWARE_DRIVER
0x0000000d
Driver.
SHTDN_REASON_MINOR_HOTFIX
0x00000011
Hot fix.
SHTDN_REASON_MINOR_HOTFIX_UNINSTALL
0x00000017
Hot fix uninstallation.
SHTDN_REASON_MINOR_HUNG
0x00000005
Unresponsive.
SHTDN_REASON_MINOR_INSTALLATION
0x00000002
Installation.
SHTDN_REASON_MINOR_MAINTENANCE
0x00000001
Maintenance.
SHTDN_REASON_MINOR_MMC
0x00000019
MMC issue.
SHTDN_REASON_MINOR_NETWORK_CONNECTIVITY
0x00000014
Network connectivity.
SHTDN_REASON_MINOR_NETWORKCARD
0x00000009
Network card.
SHTDN_REASON_MINOR_OTHER
0x00000000
Other issue.
SHTDN_REASON_MINOR_OTHERDRIVER
0x0000000e
Other driver event.
SHTDN_REASON_MINOR_POWER_SUPPLY
0x0000000a
Power supply.
SHTDN_REASON_MINOR_PROCESSOR
0x00000008
Processor.
SHTDN_REASON_MINOR_RECONFIG
0x00000004
Reconfigure.
SHTDN_REASON_MINOR_SECURITY
0x00000013
Security issue.
SHTDN_REASON_MINOR_SECURITYFIX
0x00000012
Security patch.
SHTDN_REASON_MINOR_SECURITYFIX_UNINSTALL
0x00000018
Security patch uninstallation.
SHTDN_REASON_MINOR_SERVICEPACK
0x00000010
Service pack.
SHTDN_REASON_MINOR_SERVICEPACK_UNINSTALL
0x00000016
Service pack uninstallation.
SHTDN_REASON_MINOR_TERMSRV
0x00000020
Terminal Services.
SHTDN_REASON_MINOR_UNSTABLE
0x00000006
Unstable.
SHTDN_REASON_MINOR_UPGRADE
0x00000003
Upgrade.
SHTDN_REASON_MINOR_WMI
0x00000015
WMI issue.

The following optional flags provide additional information about the event.

Constant/value Description
SHTDN_REASON_FLAG_USER_DEFINED
0x40000000
The reason code is defined by the user. For more information, see Defining a Custom Reason Code.
If this flag is not present, the reason code is defined by the system.
SHTDN_REASON_FLAG_PLANNED
0x80000000
The shutdown was planned. The system generates a System State Data (SSD) file. This file contains system state information such as the processes, threads, memory usage, and configuration.
If this flag is not present, the shutdown was unplanned. Notification and reporting options are controlled by a set of policies. For example, after logging in, the system displays a dialog box reporting the unplanned shutdown if the policy has been enabled. An SSD file is created only if the SSD policy is enabled on the system. The administrator can use Windows Error Reporting to send the SSD data to a central location, or to Microsoft.

Remarks

The following combinations are recognized by the system. The table indicates the string that is displayed in the Shutdown Event Tracker, and provides a more detailed description. The default string is "No title for this reason could be found."

Combination Description
SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_HUNG "Application: Unresponsive" An unplanned restart or shutdown to troubleshoot an unresponsive application.
SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_INSTALLATION | SHTDN_REASON_FLAG_PLANNED "Application: Installation (Planned)" A planned restart or shutdown to perform application installation.
SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_MAINTENANCE "Application: Maintenance (Unplanned)" An unplanned restart or shutdown to service an application.
SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_MAINTENANCE | SHTDN_REASON_FLAG_PLANNED "Application: Maintenance (Planned)" A planned restart or shutdown to perform planned maintenance on an application.
SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_UNSTABLE "Application: Unstable" An unplanned restart or shutdown to troubleshoot an unstable application.
SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_INSTALLATION "Hardware: Installation (Unplanned)" An unplanned restart or shutdown to begin or complete hardware installation.
SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_INSTALLATION | SHTDN_REASON_FLAG_PLANNED "Hardware: Installation (Planned)" A planned restart or shutdown to begin or complete hardware installation.
SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_MAINTENANCE "Hardware: Maintenance (Unplanned)" An unplanned restart or shutdown to service hardware on the system.
SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_MAINTENANCE | SHTDN_REASON_FLAG_PLANNED "Hardware: Maintenance (Planned)" A planned restart or shutdown to service hardware on the system.
SHTDN_REASON_MAJOR_LEGACY_API "Legacy API shutdown" This shutdown was initiated by the legacy InitiateSystemShutdown function. Applications should use the InitiateSystemShutdownEx function.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_HOTFIX "Operating System: Hot fix (Unplanned)" An unplanned restart or shutdown to install a hot fix.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_HOTFIX | SHTDN_REASON_FLAG_PLANNED "Operating System: Hot fix (Planned)" A planned restart or shutdown to install a hot fix.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_RECONFIG "Operating System: Reconfiguration (Unplanned)" An unplanned restart or shutdown to change the operating system configuration.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_RECONFIG | SHTDN_REASON_FLAG_PLANNED "Operating System: Reconfiguration (Planned)" A planned restart or shutdown to change the operating system configuration.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_SECURITYFIX "Operating System: Security fix (Unplanned)" An unplanned restart or shutdown to install a security patch.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_SECURITYFIX | SHTDN_REASON_FLAG_PLANNED "Operating System: Security fix (Planned)" A planned restart or shutdown to install a security patch.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_SERVICEPACK | SHTDN_REASON_FLAG_PLANNED "Operating System: Service pack (Planned)" A planned restart or shutdown to install a service pack.
SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_UPGRADE | SHTDN_REASON_FLAG_PLANNED "Operating System: Upgrade (Planned)" A planned restart or shutdown to upgrade the operating system configuration.
SHTDN_REASON_MAJOR_OTHER | SHTDN_REASON_MINOR_OTHER "Other (Unplanned)" An unplanned shutdown or restart.
SHTDN_REASON_MAJOR_OTHER | SHTDN_REASON_MINOR_OTHER | SHTDN_REASON_FLAG_PLANNED "Other (Planned)" A planned shutdown or restart.
SHTDN_REASON_MAJOR_OTHER | SHTDN_REASON_MINOR_HUNG "Other Failure: System Unresponsive" The system became unresponsive.
SHTDN_REASON_MAJOR_POWER | SHTDN_REASON_MINOR_CORDUNPLUGGED "Power Failure: Cord Unplugged" The computer was unplugged.
SHTDN_REASON_MAJOR_POWER | SHTDN_REASON_MINOR_ENVIRONMENT "Power Failure: Environment" There was a power outage.
SHTDN_REASON_MAJOR_SYSTEM | SHTDN_REASON_MINOR_BLUESCREEN "System Failure: Stop error" The computer displayed a blue screen crash event.
SHTDN_REASON_MAJOR_SYSTEM | SHTDN_REASON_MINOR_NETWORK_CONNECTIVITY "Loss of network connectivity (Unplanned)" The computer needs to be shut down due to a network connectivity issue.
SHTDN_REASON_MAJOR_SYSTEM | SHTDN_REASON_MINOR_SECURITY "Security issue" The computer needs to be shut down due to a security issue.

 

You can also define your own shutdown reasons and add them to the registry. Each reason code should be stored as a registry value in the following key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\UserDefined\<default_system_language_ID>

This key contains value names of the following form: xxxxx;nnn;nnnnn. The semicolons delimit the components of a value name.

xxxxx

One to five of the following control flags (no other characters can be used).

Flag Description
P Planned shutdown; otherwise, an unplanned shutdown.
C A comment is required. This flag must be used with S.
B An ID is required. This flag must be used with D.
S Display the expected shutdown dialog box. Either S, D, or both S and D must be used.
D Display the unexpected shutdown dialog box. Either S, D, or both S and D must be used.

 

The order in which the flags are used is not important. For example, CSP indicates a planned shutdown where the expected shutdown dialog box is displayed, and a comment is required.

nnn

Major reason. This component must be a number in the range 64-255. The range 0-63 is reserved for use by the system.

nnnnn

Minor reason. This component must be in the range 0-65535.

Custom reasons are sorted in the user interface by major reason number, then by minor reason number. No two custom reasons can use the same major and minor reasons, unless one is planned and the other is unplanned. Otherwise, the system will use the first instance and ignore the others.

The data for each registry value is two strings, separated by \n\r. The first string is a title string to be displayed in the shutdown dialog box, and written to the event log. The maximum size is 64 characters. Title strings must be unique. Custom titles cannot match the standard titles defined by the system, or another custom title. The second string is a description string to be displayed in the shutdown dialog box; it is optional. The maximum size is 256 characters.

Requirements

Minimum supported client
Windows XP [desktop apps | UWP apps]
Minimum supported server
Windows Server 2003 [desktop apps | UWP apps]
Header
Reason.h