Windows shutdown should be quick but sometimes it's not.
Scenario:
The system takes a 'long' time to shutdown. Not too long in this case, only 12.78 seconds, but who has that kind of time?
Analysis:
Shutdown traces are quite a bit different then boot up and logon performance traces. In a shutdown sceario you want processes and drivers to stop and unload as fast as possible. There are a few issues that may stop this from happening, like A GPO logoff or shutdown script, clearing the pagefile on shutdown, slow service shutdown, open applications and others.
There are WPA.exe profiles for shutdown analysis in the WPA Profiles folder.
Services
I like to look at any services that are not shutting down in a timely manner first. There is a maximum wait time for services to shutdown on Windows shutdown, by default the time is 5 seconds. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WaitToKillServiceTimeout
Order the End Thread ID column ascending and you will find some services that have a thread ID of 0. These are the last services that were running on shutdown. They are services that were not able to shutdown before the operating system stopped. Look for any service that could not shutdown and that has a high Service Init Time (s) value. In this case the Rasman service did not shutdown and this Init time is 6.039970997 seconds.
Processes
Processes that are slow to exit can also be an issue with a slow shutdown. There are a few graphs that are important in investigating processes. 'Window in Focus', 'Processes' and 'Images' are some of the important graphs.
Opening the 'Window in Focus' graph will show any applications that had a window open on the desktop at the time of the trace. To find processes that could be slowing down the shutdown sort descending by Duration (s) Sum column. See that there are 3 major processes taking up the time, LogonUI.exe (19492), Skype.exe (1892) and wlrmdr.exe (20636). LogonUI.exe will run after the desktop is shutdown and while Windows is showing 'Shutting Down' screen so it can be ignored. Skype.exe is taking 3.494 seconds to exit which is a bit long. wlrmdr.exe process is also taking 1.708 seconds to exit but this is the 'Windows logon reminder' process which shuts down the machine when taking a shutdown trace so it can be ignored as well.
Drivers
Slow driver shutdown can cause the shutdown to be slow as well.
**Overall CPU and Disk Usage
Use the 'CPU Usage (Sampled)' graph to view the CPU usage and look for high CPU usage during shutdown. In this trace the CPU is 96.19% idle weight so there is plenty of CPU. When taking a shutdown trace a verbose trace with callstacks is usually needed so any wait chains within processes can be investigated.
Always check the CPU frequency as well to make sure the CPUs were not throttled down in speed during the shutdown. Oscillating GHz values are normal, look for an extended time of low GHz. In this trace at the time of shutting down the Rasman service the CPU frequency was at maximum, so no issues with CPU speed throttling.
Remediation:
Shutting down Skype.exe process before shutting down first could help the slow shutdown. The Rasman service can also be investigated to see why it is taking 6 seconds to shutdown. If these 2 issues can be fixed the shutdown time could be reduced by ~9 seconds.
Windows shutdown should be quick but sometimes it's not.
Scenario:
The system takes a 'long' time to shutdown. Not too long in this case, only 12.78 seconds, but who has that kind of time?
Analysis:
Shutdown traces are quite a bit different then boot up and logon performance traces. In a shutdown sceario you want processes and drivers to stop and unload as fast as possible. There are a few issues that may stop this from happening, like A GPO logoff or shutdown script, clearing the pagefile on shutdown, slow service shutdown, open applications and others.
There are WPA.exe profiles for shutdown analysis in the WPA Profiles folder.
Services
I like to look at any services that are not shutting down in a timely manner first. There is a maximum wait time for services to shutdown on Windows shutdown, by default the time is 5 seconds. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WaitToKillServiceTimeout
Order the End Thread ID column ascending and you will find some services that have a thread ID of 0. These are the last services that were running on shutdown. They are services that were not able to shutdown before the operating system stopped. Look for any service that could not shutdown and that has a high Service Init Time (s) value. In this case the Rasman service did not shutdown and this Init time is 6.039970997 seconds.
Processes
Processes that are slow to exit can also be an issue with a slow shutdown. There are a few graphs that are important in investigating processes. 'Window in Focus', 'Processes' and 'Images' are some of the important graphs.
Opening the 'Window in Focus' graph will show any applications that had a window open on the desktop at the time of the trace. To find processes that could be slowing down the shutdown sort descending by Duration (s) Sum column. See that there are 3 major processes taking up the time, LogonUI.exe (19492), Skype.exe (1892) and wlrmdr.exe (20636). LogonUI.exe will run after the desktop is shutdown and while Windows is showing 'Shutting Down' screen so it can be ignored. Skype.exe is taking 3.494 seconds to exit which is a bit long. wlrmdr.exe process is also taking 1.708 seconds to exit but this is the 'Windows logon reminder' process which shuts down the machine when taking a shutdown trace so it can be ignored as well.
Drivers
Slow driver shutdown can cause the shutdown to be slow as well.
**Overall CPU and Disk Usage
Use the 'CPU Usage (Sampled)' graph to view the CPU usage and look for high CPU usage during shutdown. In this trace the CPU is 96.19% idle weight so there is plenty of CPU. When taking a shutdown trace a verbose trace with callstacks is usually needed so any wait chains within processes can be investigated.
Always check the CPU frequency as well to make sure the CPUs were not throttled down in speed during the shutdown. Oscillating GHz values are normal, look for an extended time of low GHz. In this trace at the time of shutting down the Rasman service the CPU frequency was at maximum, so no issues with CPU speed throttling.
Remediation:
Shutting down Skype.exe process before shutting down first could help the slow shutdown. The Rasman service can also be investigated to see why it is taking 6 seconds to shutdown. If these 2 issues can be fixed the shutdown time could be reduced by ~9 seconds.