System Shutdown Reason Codes
The shutdown reason codes are used by the ExitWindowsEx and InitiateSystemShutdownEx functions in the dwReason parameter.
A maximum of MAX_NUM_REASONS reason codes will be processed by the system. MAX_NUM_REASONS is defined in reason.h.
The following are the major reason flags. They indicate the general issue type.
| Constant/value | Description |
|---|---|
|
Application issue. |
|
Hardware issue. |
|
The InitiateSystemShutdown function was used instead of InitiateSystemShutdownEx. |
|
Operating system issue. |
|
Other issue. |
|
Power failure. |
|
Software issue. |
|
System failure. |
The following are the minor reason flags. They modify the specified major reason flag. You can use any minor reason in conjunction with any major reason, but some combinations do not make sense.
| Constant/value | Description |
|---|---|
|
Blue screen crash event. |
|
Unplugged. |
|
Disk. |
|
Environment. |
|
Driver. |
|
Hot fix. |
|
Hot fix uninstallation. |
|
Unresponsive. |
|
Installation. |
|
Maintenance. |
|
MMC issue. |
|
Network connectivity. |
|
Network card. |
|
Other issue. |
|
Other driver event. |
|
Power supply. |
|
Processor. |
|
Reconfigure. |
|
Security issue. |
|
Security patch. |
|
Security patch uninstallation. |
|
Service pack. |
|
Service pack uninstallation. |
|
Terminal Services. |
|
Unstable. |
|
Upgrade. |
|
WMI issue. |
The following optional flags provide additional information about the event.
| Constant/value | Description |
|---|---|
|
The reason code is defined by the user. For more information, see Defining a Custom Reason Code. If this flag is not present, the reason code is defined by the system. |
|
The shutdown was planned. The system generates a System State Data (SSD) file. This file contains system state information such as the processes, threads, memory usage, and configuration. If this flag is not present, the shutdown was unplanned. Notification and reporting options are controlled by a set of policies. For example, after logging in, the system displays a dialog box reporting the unplanned shutdown if the policy has been enabled. An SSD file is created only if the SSD policy is enabled on the system. The administrator can use Windows Error Reporting to send the SSD data to a central location, or to Microsoft. |
Remarks
The following combinations are recognized by the system. The table indicates the string that is displayed in the Shutdown Event Tracker, and provides a more detailed description. The default string is "No title for this reason could be found."
| Combination | Description |
|---|---|
| SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_HUNG | "Application: Unresponsive" An unplanned restart or shutdown to troubleshoot an unresponsive application. |
| SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_INSTALLATION | SHTDN_REASON_FLAG_PLANNED | "Application: Installation (Planned)" A planned restart or shutdown to perform application installation. |
| SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_MAINTENANCE | "Application: Maintenance (Unplanned)" An unplanned restart or shutdown to service an application. |
| SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_MAINTENANCE | SHTDN_REASON_FLAG_PLANNED | "Application: Maintenance (Planned)" A planned restart or shutdown to perform planned maintenance on an application. |
| SHTDN_REASON_MAJOR_APPLICATION | SHTDN_REASON_MINOR_UNSTABLE | "Application: Unstable" An unplanned restart or shutdown to troubleshoot an unstable application. |
| SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_INSTALLATION | "Hardware: Installation (Unplanned)" An unplanned restart or shutdown to begin or complete hardware installation. |
| SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_INSTALLATION | SHTDN_REASON_FLAG_PLANNED | "Hardware: Installation (Planned)" A planned restart or shutdown to begin or complete hardware installation. |
| SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_MAINTENANCE | "Hardware: Maintenance (Unplanned)" An unplanned restart or shutdown to service hardware on the system. |
| SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_MAINTENANCE | SHTDN_REASON_FLAG_PLANNED | "Hardware: Maintenance (Planned)" A planned restart or shutdown to service hardware on the system. |
| SHTDN_REASON_MAJOR_LEGACY_API | "Legacy API shutdown" This shutdown was initiated by the legacy InitiateSystemShutdown function. Applications should use the InitiateSystemShutdownEx function. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_HOTFIX | "Operating System: Hot fix (Unplanned)" An unplanned restart or shutdown to install a hot fix. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_HOTFIX | SHTDN_REASON_FLAG_PLANNED | "Operating System: Hot fix (Planned)" A planned restart or shutdown to install a hot fix. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_RECONFIG | "Operating System: Reconfiguration (Unplanned)" An unplanned restart or shutdown to change the operating system configuration. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_RECONFIG | SHTDN_REASON_FLAG_PLANNED | "Operating System: Reconfiguration (Planned)" A planned restart or shutdown to change the operating system configuration. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_SECURITYFIX | "Operating System: Security fix (Unplanned)" An unplanned restart or shutdown to install a security patch. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_SECURITYFIX | SHTDN_REASON_FLAG_PLANNED | "Operating System: Security fix (Planned)" A planned restart or shutdown to install a security patch. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_SERVICEPACK | SHTDN_REASON_FLAG_PLANNED | "Operating System: Service pack (Planned)" A planned restart or shutdown to install a service pack. |
| SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_UPGRADE | SHTDN_REASON_FLAG_PLANNED | "Operating System: Upgrade (Planned)" A planned restart or shutdown to upgrade the operating system configuration. |
| SHTDN_REASON_MAJOR_OTHER | SHTDN_REASON_MINOR_OTHER | "Other (Unplanned)" An unplanned shutdown or restart. |
| SHTDN_REASON_MAJOR_OTHER | SHTDN_REASON_MINOR_OTHER | SHTDN_REASON_FLAG_PLANNED | "Other (Planned)" A planned shutdown or restart. |
| SHTDN_REASON_MAJOR_OTHER | SHTDN_REASON_MINOR_HUNG | "Other Failure: System Unresponsive" The system became unresponsive. |
| SHTDN_REASON_MAJOR_POWER | SHTDN_REASON_MINOR_CORDUNPLUGGED | "Power Failure: Cord Unplugged" The computer was unplugged. |
| SHTDN_REASON_MAJOR_POWER | SHTDN_REASON_MINOR_ENVIRONMENT | "Power Failure: Environment" There was a power outage. |
| SHTDN_REASON_MAJOR_SYSTEM | SHTDN_REASON_MINOR_BLUESCREEN | "System Failure: Stop error" The computer displayed a blue screen crash event. |
| SHTDN_REASON_MAJOR_SYSTEM | SHTDN_REASON_MINOR_NETWORK_CONNECTIVITY | "Loss of network connectivity (Unplanned)" The computer needs to be shut down due to a network connectivity issue. |
| SHTDN_REASON_MAJOR_SYSTEM | SHTDN_REASON_MINOR_SECURITY | "Security issue" The computer needs to be shut down due to a security issue. |
You can also define your own shutdown reasons and add them to the registry. Each reason code should be stored as a registry value in the following key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\UserDefined\<default_system_language_ID>
This key contains value names of the following form: xxxxx;nnn;nnnnn. The semicolons delimit the components of a value name.
-
xxxxx
-
One to five of the following control flags (no other characters can be used).
Flag Description P Planned shutdown; otherwise, an unplanned shutdown. C A comment is required. This flag must be used with S. B An ID is required. This flag must be used with D. S Display the expected shutdown dialog box. Either S, D, or both S and D must be used. D Display the unexpected shutdown dialog box. Either S, D, or both S and D must be used. The order in which the flags are used is not important. For example, CSP indicates a planned shutdown where the expected shutdown dialog box is displayed, and a comment is required.
-
nnn
-
Major reason. This component must be a number in the range 64-255. The range 0-63 is reserved for use by the system.
-
nnnnn
-
Minor reason. This component must be in the range 0-65535.
Custom reasons are sorted in the user interface by major reason number, then by minor reason number. No two custom reasons can use the same major and minor reasons, unless one is planned and the other is unplanned. Otherwise, the system will use the first instance and ignore the others.
The data for each registry value is two strings, separated by \n\r. The first string is a title string to be displayed in the shutdown dialog box, and written to the event log. The maximum size is 64 characters. Title strings must be unique. Custom titles cannot match the standard titles defined by the system, or another custom title. The second string is a description string to be displayed in the shutdown dialog box; it is optional. The maximum size is 256 characters.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows XP [desktop apps | UWP apps] |
| Minimum supported server |
Windows Server 2003 [desktop apps | UWP apps] |
| Header |
|
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for