What Fast Startup Really Does — Why a Windows 'Shutdown' Is Not the Same as a Restart

“I shut down and turned the power back on, but the printer is not recognized. Then I restarted, and it worked.”

The key to understanding this difference is Windows Fast Startup. Since Windows 8, on a PC that supports hibernation and has this feature enabled, “Shut down” is not an operation that rebuilds all of Windows’ state. It closes apps and the user session, but saves the state of the kernel, drivers, and services and restores it on the next boot. This is called a hybrid shutdown.¹²

By contrast, “Restart” always performs a full boot cycle, regardless of the Fast Startup setting. “Turn it off and on again” and “restart” are not the same operation.¹

This article first shows how to choose the right operation, then moves on to the reasons, symptom-by-symptom isolation, how to verify, and how to decide on configuration changes. Implementation notes for APIs and Windows services are collected in Section 7. The intended readers are IT staff who manage Windows 10/11 and developers of Windows apps for device PCs and test machines. PowerShell 5.1 or later is used for checking and configuration.

1. The Bottom Line First: Pick the Operation That Matches Your Goal

Before turning Fast Startup off outright, separate out what you are trying to do.

The basis for this choice is the following three differences.¹³⁴

flowchart TB
    accTitle: The three power menu operations and what actually happens
    accDescr: Shut down is a hybrid shutdown by default and saves the kernel to the hibernation file. Restart always performs a full boot cycle. Hibernate saves the user session as well to the hibernation file.
    shutdown["Shut down"] --> hybrid["Hybrid shutdown (default)"]
    hybrid --> saveKernel["Save the kernel to the hibernation file"]
    restart["Restart"] --> full["Full boot cycle"]
    full --> reinit["Rebuild the kernel, drivers, and services"]
    hibernate["Hibernate"] --> s4["Hibernation (S4)"]
    s4 --> saveAll["Save all of memory"]

Figure 1: “Shut down” saves the state; “Restart” rebuilds the Windows-side state. A normal hibernation saves the user session as well. Even a restart does not cut the power to the connected devices.

“Resetting once” and “changing how you shut down every time” are separate decisions. For ordinary business laptops, the practical choice is to leave it on and restart when needed. Microsoft does not recommend disabling Fast Startup across the board either.¹

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (24 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

2. How It Works: Windows “Restores” Its State Instead of Rebuilding It

2.1 Where It Diverges from a Full Shutdown

Windows has three boot modes: the traditional cold boot, resume from hibernation, and Fast Startup, which was introduced in Windows 8. In a cold boot, the boot loader loads the kernel into memory and links it, and the kernel configures its core functionality, enumerates the connected devices, and loads drivers. Fast Startup instead reads the already-initialized state back from the hibernation file.⁵

The preparation for reading it back happens at the previous shutdown. Up to closing apps and signing out all users, it is the same as a full shutdown. After that, the paths diverge.⁵¹

What drivers receive, too, is not a shutdown notification but a power IRP announcing a transition to hibernation. Although it looks like a power-off to the user, the core of Windows does not terminate; it is preserved until the next boot.⁵

2.2 What Is Saved and What Is Closed

The boundary lies between the user sessions (the interactive sessions, Session 1 and later) and the kernel session (Session 0).⁶²

Per-user services and Session 0 services are both “services”, but they are handled differently. The former are created at sign-in and stopped and deleted at sign-out, so they are not carried over.⁷

On the saved side, by contrast, drivers’ internal state and the handles, memory, and internal caches held by system services remain. Microsoft’s hardware documentation also explains that because the kernel, drivers, and services are saved and restored rather than restarted, the uptime between kernel restarts can be longer than on earlier versions of Windows, and asks that memory leaks in drivers and services be monitored.²

2.3 How It Differs from a Normal Hibernation

A normal hibernation saves all of memory, including the user sessions. Fast Startup signs the users out first and then saves. That makes the hibernation file smaller and both writing it out and reading it back faster.²⁶

In power-state terminology, a full shutdown is S5 and hibernation is S4. A hybrid shutdown looks like S5 to the user but actually passes through S4. However, the response to device wake alarms is treated as if the system were in S5. Even though it is the same S4, not everything behaves the same as in a normal hibernation, and this difference matters for Wake on LAN in 4.4.⁶

2.4 The Next Boot “Resumes” Instead of “Initializing”

A boot from Fast Startup proceeds in this order: firmware initialization, reading the hibernation file, resuming devices, resuming Winlogon, and initializing Explorer. The hibernation file holds the system context that was written out at shutdown.⁸

What matters here is that devices are resumed, not initialized. If a driver was internally holding a bad state, such as a peripheral not being recognized or a USB device not responding after resume, that state can be carried over as well.

“Restart” does not use this save-and-restore path; it always goes through a full boot. The reason a restart is required after installing a driver, or after updating Windows components that cannot be replaced without a full restart, is precisely to rebuild the Windows-side state.¹

3. Resetting or Fully Shutting Down Without Changing Settings

3.1 To Reset and Keep Using the PC: “Restart”

To isolate a problem, or to return Windows to a clean state once, choose “Restart” from the power menu. Because it does not depend on the Fast Startup setting, it is also the reliable operation to write into procedures.¹

Note, however, that a restart is a full boot cycle, not an operation that leaves the PC powered off (S5). When Windows must be terminated completely and the power cut, for example before handling the disk from another OS, use the following method.

3.2 To Cut the Power as Well: shutdown /s /t 0

Save your work, then run the following command.

shutdown /s /t 0

The /s of Shutdown.exe is a full shutdown by default. Combine /hybrid with /s only when you want a hybrid shutdown. The power menu’s “Shut down” and the command’s /s have different default behaviors.¹⁹

In the shutdown sequence of a device PC or in a batch file, this command makes the intent, “terminate completely and cut the power”, unambiguous. Note that /g fully shuts down and then restarts, resuming registered apps if Automatic Restart Sign-On (ARSO) is enabled; it is not an option for staying powered off.⁹

3.3 The Shift Key Method, and Calling from an App

Selecting “Shut down” while holding the Shift key performs a full shutdown for that one time only. However, this procedure is described in a support answer on Microsoft Q&A, not in an official reference. If you use it in operations, verify the result with the uptime or Event 27 described in Section 5; for user-facing procedures, “Restart” or shutdown /s /t 0 is the safer choice in terms of reliability.¹⁰

An app can also perform a full shutdown through the API, for example by calling InitiateSystemShutdownEx with bRebootAfterShutdown set to FALSE. The flags for each API, the difference between power-off and restart, and the required privilege are summarized in Section 7.¹¹

4. Isolating the Cause by Symptom

The mechanism described so far explains uptime and carried-over problems. But do not assume that the symptom in front of you is caused by Fast Startup. Wake on LAN in particular must be isolated as a separate constraint.

4.1 A Shutdown Does Not Fix It, but a Restart Does

The first thing to do is check whether the problem reproduces after a restart. If it disappears after a restart, the hypothesis that state carried over in a driver or service is the cause becomes strong.

It is not confirmed, though, just because a restart fixed it. An intermittent problem may simply not have appeared, or the restart may have completed a pending update. Before treating it as the cause, obtain the following corroboration.

1. Confirm several times that “it reproduces after a shutdown and does not reproduce after a restart”.
2. Confirm with the Kernel-Boot Event 27 described in Section 5 that the most recent boot was Fast Startup (0x1).
3. Cross-check against the driver-side records in Device Manager and the System log.

Even once corroborated, there is no need to change the setting on every machine right away. In most cases, correcting the procedure from “turn it off and on again” to “restart” is enough. Whether a machine needs guaranteed initialization at every shutdown is decided in Section 6.

When the shutdown itself fails and returns to the lock screen, a different check is needed. A shutdown with Fast Startup enabled runs as a hibernation, and partway through it initializes the memory dump configuration. If the dump filter driver cannot be loaded, the hibernation fails, Event ID 45 is logged, and the system returns to the lock screen. The place Microsoft points to is DumpFilters under HKLM\SYSTEM\CurrentControlSet\Control\CrashControl. Treating this symptom as a “hibernation failure” rather than a “shutdown failure” makes it clear where to look.¹

4.2 Uptime Does Not Reset Despite Shutting Down Every Night

Task Manager’s “Performance” > “CPU” sometimes shows an uptime of many days. In a hybrid shutdown the kernel is only hibernated and restored, so the kernel’s boot time is not updated.²

In WMI, uptime is obtained from Win32_OperatingSystem.LastBootUpTime by subtracting the boot time from the current time. A restart, which goes through a full boot, and a boot after a full shutdown update this reference boot time.¹²

Get-Uptime in PowerShell 6 and later uses the high-resolution timer’s tick count since system start. Its value can therefore differ slightly from the one derived from WMI, but it is the same in taking the kernel’s boot as the reference.¹³

Do not conclude either a fault or Fast Startup from a long uptime alone. Uptime is also preserved across sleep, an explicit hibernation, and a shutdown that did not complete. Check Event 27 and the surrounding log entries before you explain it.

Also, monitoring such as “prompt a restart when uptime exceeds 30 days” will warn users who shut down every day. The monitoring is not wrong. Wording the notification as “please restart” avoids the confusion of “but I shut down last night”.

4.3 Updates Do Not Finish Even After “Update and shut down”

To finish an update, choose “Update and restart”. Microsoft’s support article (KB4011287) explains that some updates can complete only in a boot that follows a full shutdown, and may be held pending when the boot goes through Fast Startup’s hibernation. This behavior does not occur with a restart.³

When “Updating” appears again the next morning after “Update and shut down”, it is usually not an update failure; the processing that was waiting for a full boot is simply proceeding in that boot. If Fast Startup is disabled, “Update and shut down” also goes through a full boot, so the premise changes.

The same support article also notes that the delay in completing updates in environments managed by Configuration Manager was addressed in Configuration Manager 2002 and Windows 10 21H1.³

4.4 Wake on LAN Cannot Wake a PC That Was Shut Down

Turning Fast Startup off alone does not solve this problem. On Windows 10/11, Wake on LAN (WOL) as far as Windows is concerned is not supported from either a hybrid shutdown or a full shutdown (S5).⁴¹⁴

Even though both are S4, Windows treats “Hibernate” and “Shut down” differently. According to Microsoft’s explanation, a user who orders a shutdown expects zero power consumption, so Windows does not arm the NIC for wake on the transition to a hybrid shutdown. This disabling is not performed on the transition to an explicit hibernation.⁴

On Windows 7, too, WOL from the default full shutdown (S5) was not officially supported. There were, however, models on which the NIC stayed armed for wake if residual power was available. The difference with Windows 10’s default hybrid shutdown is that Windows explicitly disables wake.⁴

Modern Standby machines cannot be generalized as “they always wake as long as they are asleep”. A model that shows “S0 Low Power Idle” in powercfg /a has no S3. In Modern Standby the system keeps running at low power even with the screen off, and Wi-Fi, Ethernet, and mobile broadband maintain their connections and can be wake sources. Microsoft’s documentation also states that Remote Desktop and file sharing can wake the SoC over an Ethernet connection.¹⁵

The same documentation, however, also lists the following conditions.¹⁵

• In disconnected standby, apps cannot use the network, and on battery power the network stack may begin disconnecting.
• Wired LAN does not qualify as Modern Standby capable unless it supports pattern-match offload.
• On Windows 11 version 24H2 and later, many wake sources are disabled when excessive battery drain is detected.

On Surface, WOL during Modern Standby is stated to work by default since Windows 10 version 1607, but that is no guarantee for laptops from other manufacturers. Whether a PC can actually be woken is determined by the NIC, the firmware, the AC/DC power conditions, and the OEM’s implementation, so verify on a real machine before building it into unattended operations such as overnight jobs.¹⁶

There are also models whose firmware and hardware can arm the NIC for wake from S4/S5 on their own. In that case Windows is not involved. “Some models do wake from a shutdown” refers to this exception.⁴

Operationally, the basic approach is to leave the machine you want to wake waiting in “Sleep” or “Hibernate”. Even if the NIC’s “Wake on Magic Packet” and similar settings are configured correctly, the PC will not wake if the OS’s power transition has disabled wake. How drivers tell the two apart is explained in 7.5. See also “Sleep, Hibernation, Modern Standby, and Long-Running Apps” for Modern Standby behavior and “A Guide to Windows NIC Advanced Settings” for NIC settings.

4.5 Dual Boot, or Handling the Same Disk from Another OS

This section is a caution derived from the mechanism, based on the primary sources on power states. In a hybrid shutdown, the kernel’s memory image is saved and restored on the next boot.⁶

Pending writes are committed to disk at the point of entering hibernation, but the file system driver’s caches and its assumptions about the volume’s structure remain in the hibernation file. If another OS (Linux, Windows PE, and so on) writes to the same NTFS volume in the meantime, the stale view that Windows restores on the next boot will disagree with what is actually on the disk.

The danger is not hibernation itself but Windows restoring the old state after another OS has modified the disk. When the NTFS driver on the Linux side refuses to write to a hibernated volume, or mounts it read-only, that is correct behavior meant to prevent exactly this inconsistency.

On a machine that handles the same disk from several operating systems, or a test machine that boots a separate OS for repair, build one of the following into your operations.

• Turn Fast Startup off and also disable explicit hibernation with powercfg /h off.
• Require the full shutdown from Section 3 before switching operating systems.

Turning Fast Startup off alone leaves explicit hibernation available. Be aware that writing from another OS while Windows is hibernated causes the same inconsistency.

4.6 Firmware Settings or Device Configuration Changes Do Not Take Effect

If you changed UEFI settings or the configuration of peripherals, yet the old state appears to remain even after turning the power off and on, restart to go through a full boot. With Fast Startup, drivers take the resume path, not the cold-boot initialization path.

Microsoft asks that drivers which configure a device differently on a cold boot and on a resume from hibernation configure it as for a cold boot after Fast Startup. In drivers not implemented that way, the resume path becomes the problem. How a driver tells the two apart is summarized in 7.5.⁵

5. Checking the “Setting” and the “Actual Boot Path” Separately

Even when Fast Startup is enabled in the settings, the most recent boot did not necessarily take that path. Read the information that tells you the setting and the information that tells you the boot result separately.

5.1 Four Places to Check

How to think about uptime is covered in 4.2, and the relationship between the hibernation file and the setting is also explained in 6.3 and 6.4.²⁶¹⁷¹⁸

5.2 How to Read Event 27

Kernel-Boot Event 27 records a value at boot such as “The boot type was 0x1”. The meaning of the value is not documented in the official reference, but the following mapping is widely known.

Even if the uptime is continuing, a most recent value of 0x2 means a resume from a normal hibernation, not Fast Startup. Do not explain from the uptime alone; combine it with Event 27.

5.3 Checking Everything at Once with PowerShell

The following script displays the setting, the hibernation file, the uptime, and the type of the last five boots together. Most of the registry and event log reads work without administrator rights, but powercfg /a requires administrator rights in some environments.

# Show the Fast Startup setting and the type of the most recent boots together
$powerKey  = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power'
$policyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'

$local  = Get-ItemProperty -Path $powerKey  -Name HiberbootEnabled -ErrorAction SilentlyContinue
$policy = Get-ItemProperty -Path $policyKey -Name HiberbootEnabled -ErrorAction SilentlyContinue
$os     = Get-CimInstance -ClassName Win32_OperatingSystem
$hiberfil = Test-Path -LiteralPath "$env:SystemDrive\hiberfil.sys"

# Without a hibernation file (powercfg /h off), Fast Startup does not work regardless of the registry value.
# The "Require use of fast startup" policy takes precedence over the local setting only when it is Enabled (1).
# If the policy value is 0 or not configured, the local setting is used (no value means enabled by default)
$effective =
    if (-not $hiberfil) { 'Not available (no hibernation file: the powercfg /h off state)' }
    elseif ($null -ne $policy -and $policy.HiberbootEnabled -eq 1) { 'Enabled (forced by policy)' }
    elseif ($null -eq $local -or $local.HiberbootEnabled -eq 1) { 'Enabled (local setting)' }
    else { 'Disabled (local setting)' }

[pscustomobject]@{
    LocalHiberbootEnabled  = if ($null -eq $local)  { '(no value: enabled by default)' } else { $local.HiberbootEnabled }
    PolicyHiberbootEnabled = if ($null -eq $policy) { '(not configured)' } else { $policy.HiberbootEnabled }
    EffectiveSetting       = $effective
    HiberfilExists         = $hiberfil
    LastBootUpTime         = $os.LastBootUpTime
    Uptime                 = (Get-Date) - $os.LastBootUpTime
} | Format-List

# Type of the last five boots (0x0 = full boot, 0x1 = Fast Startup, 0x2 = resume from hibernation)
Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-Kernel-Boot'; Id = 27 } -MaxEvents 5 |
    Select-Object TimeCreated, Message

# Available sleep states and the type of the hibernation file
powercfg /a

The effective setting shown here is decided in this order: whether a hibernation file exists, whether the policy forces it on, and what the local setting is. If the policy value is 0 or not configured, the local setting is used, and without a hibernation file, Fast Startup is unavailable whatever the setting values are.

5.4 “Who Requested the Shutdown” Is in a Different Log

Event ID 1074 (User32) in the System log records the requesting process, user, and reason code, and the requested operation (power off, restart, and so on). However, because both a hybrid and a full shutdown are recorded as a power off, 1074 alone cannot tell the two apart. Confirm the actual path with Event 27 at the next boot.

Unexpected stops are isolated from the sequence with 41 (Kernel-Power) and 6008 (EventLog).¹⁹ The procedure for tracking down “the device PC had stopped by morning” is covered in “Windows Shutdown as Seen from Your App”.

6. Deciding Whether to Turn Fast Startup Off, and How

6.1 Decide by the Machine’s Role, Not Across the Board

Microsoft enables Fast Startup by default and does not recommend disabling it. It has a boot-time benefit, and the hardware documentation treats reading and writing the hibernation file as processing important enough to account for about 50% of boot time. On an ordinary laptop, there is no reason to turn it off across the board.¹²

The two axes for the decision are “does the operation assume that powering off initializes the machine?” and “will another OS modify the same volume?” These two are independent. Do not stop at “we turned it off because it is a device PC”; also check whether another OS writes to the disk.

6.2 Changing One Machine at a Time: Control Panel

On both Windows 10 and 11, the place to change it is Control Panel, not the Settings app.⁴

1. Open “Power Options” and select “Choose what the power buttons do”.
2. If the items are grayed out, click “Change settings that are currently unavailable” (requires administrator rights).
3. Clear the “Turn on fast startup (recommended)” check box.
4. Save the changes.

If the item itself is not shown, hibernation is disabled and there is no hibernation file. See the explanation of powercfg /a and the hibernation file in 6.4.

6.3 Configuring Many Machines: Distinguish the Registry from the Policy

The local setting is HiberbootEnabled (DWORD) under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power. 0 disables and 1 enables, and the Control Panel check box reads and writes this same value.¹⁷

# Run in a PowerShell opened as administrator. Disables Fast Startup
$powerKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power'
Set-ItemProperty -Path $powerKey -Name HiberbootEnabled -Type DWord -Value 0

# Read the value back to confirm
(Get-ItemProperty -Path $powerKey -Name HiberbootEnabled).HiberbootEnabled

However, if the “Require use of fast startup” policy is Enabled, the policy takes precedence over the local value. Even if you set the local value to 0 and read back 0, Fast Startup stays enabled. In that case, first set the policy back to Disabled or Not Configured.¹⁸

This policy is in WinInit.admx under “Computer Configuration > Administrative Templates > System > Shutdown”. It writes to HiberbootEnabled under HKLM\SOFTWARE\Policies\Microsoft\Windows\System. In Intune it can be configured as the Policy CSP ADMX_WinInit/Hiberboot.¹⁸

To roll out off across the board, distribute the local HiberbootEnabled = 0 with Group Policy Preferences or an Intune configuration. Enable this policy when you want to force on so that users cannot turn it off.

flowchart TB
    accTitle: The three layers of the Fast Startup setting
    accDescr: If the "Require use of fast startup" policy is Enabled, Fast Startup is enabled with precedence over the local setting; if it is not configured, the local HiberbootEnabled is used. On either path, Fast Startup is unavailable unless a hibernation file exists
    policy{"Policy: Require use of fast startup"}
    policy -->|"Enabled"| forced["Forced on (local setting ignored)"]
    policy -->|"Disabled or Not Configured"| local{"Local: HiberbootEnabled"}
    local -->|"1 (default)"| on["Enabled"]
    local -->|"0"| off["Disabled"]
    forced --> hib{"Does the hibernation file (hiberfil.sys) exist?"}
    on --> hib
    hib -->|"Yes (full or reduced)"| works["Fast Startup works"]
    hib -->|"No (powercfg /h off)"| none["Fast Startup unavailable"]

Figure 2: The policy is a setting that forces on. Disabling is distributed through the local registry value, and on either path Fast Startup is unavailable without a hibernation file.

The change takes effect from the next shutdown. To verify, perform a normal “Shut down”, power on, and check that Event 27 is 0x0. A restart is a full boot regardless of the setting, so it cannot be used to verify the disablement. Reading the registry back confirms the setting value; Event 27 confirms the actual path.

6.4 powercfg /h off Is Not the Same as “Turning Off Only Fast Startup”

Fast Startup relies on the hibernation file, hiberfil.sys. powercfg /hibernate off (powercfg /h off) is the operation that deletes that hibernation file. Not only Fast Startup but also normal hibernation and hybrid sleep become unavailable.²⁰⁶

Setting HiberbootEnabled = 0, on the other hand, leaves the hibernation file in place. Change the right target for each goal.

A full hibernation file supports hibernation, hybrid sleep, and Fast Startup. Hybrid sleep requires S3, though, so on a Modern Standby machine without S3 it cannot be used even with a full hibernation file. A reduced hibernation file supports only Fast Startup. On a PC that was already of the reduced type, turning off only Fast Startup does not make normal hibernation or hybrid sleep available.⁶

Read the output of powercfg /a with this distinction in mind as well.

If /type reduced fails with “The parameter is incorrect”, it is because the hibernation file size was manually set larger than 40%. First run powercfg /h /size 0 to return the size to OS management, then run it again.⁶²¹

On a machine where another OS modifies the same volume, the remaining normal hibernation causes the same inconsistency as in 4.5. Do not stop at disabling Fast Startup; also disable hibernation, or require a full shutdown before switching OS.

7. For Developers: Shutdown APIs and Service Caveats

7.1 The API Specifies “Which Operation”, Not Just “Hybrid or Not”

Shutdown APIs called from an app have different default behaviors from the power menu. According to Microsoft’s documentation, InitiateSystemShutdownEx and InitiateSystemShutdown never become hybrid, while InitiateShutdown and ExitWindowsEx request hybrid with an explicit flag.²⁶

SHUTDOWN_HYBRID is not specified alone; it is combined with one or more flags from the same table. Of those, the combination that yields a power-off for Fast Startup is the one with SHUTDOWN_POWEROFF. EWX_HYBRID_SHUTDOWN is likewise not used alone but combined with EWX_SHUTDOWN.²²²³

Removing the hybrid flag alone does not determine the operation. The following distinctions are also needed.¹¹²²²³

If you implement a “power off” button on a kiosk terminal or device PC, call InitiateSystemShutdownEx with bRebootAfterShutdown = FALSE, or call ExitWindowsEx with EWX_POWEROFF, and do not add the hybrid flag. What matters is keeping the required power-off specification, not “no flags”.

7.2 Enable the Privilege on the Right Token Before Calling

With any of these APIs, shutting down the local PC requires the SE_SHUTDOWN_NAME privilege to be enabled beforehand with AdjustTokenPrivileges. By default, a signed-in user can enable this privilege, but if you call with it still disabled, the API fails and no shutdown begins.¹¹²³

The token on which to enable it differs by API.

An ordinary desktop app or kiosk app that is not impersonating has no thread token. OpenThreadToken fails with ERROR_NO_TOKEN, so make sure the code does not proceed to the call with the privilege still disabled.

7.3 To Behave Like the Power Menu, Read the Effective Setting

EWX_HYBRID_SHUTDOWN is a flag that “requests Fast Startup”, not one that “follows that PC’s setting”.²³

If Fast Startup is turned off but the hibernation file remains on the PC, requesting with this flag means the app bypasses the user’s setting. A utility that respects the setting should check the policy, the local HiberbootEnabled, and whether the hibernation file exists, using the same rules as the script in 5.3.

Combine EWX_SHUTDOWN with EWX_HYBRID_SHUTDOWN only when the effective setting is enabled; otherwise choose a full shutdown that powers off. Confirm the result with Event 27 at the next boot.

7.4 Services Must Handle Power Events, Not Just Stop Notifications

In a hybrid shutdown, apps in the user session are closed, but Session 0 services are hibernated and restored. Per-user services are stopped and deleted at sign-out, so keep the two distinct here.²⁷

When entering hibernation, apps and services are notified first, then drivers. The important point is that on resume, drivers and services are not started over; they return to the state they were in before hibernation.⁶

Microsoft’s documentation for its assessment tools explains that suspend notifications are sent serially to services that declared SERVICE_ACCEPT_POWEREVENT, that a 30-second timeout applies per service, and that from a service’s point of view Fast Startup is the same as hibernation.²⁴

If a service hibernates while holding a connection to a device and the device is powered off in the meantime, the connection restored the next morning is already unusable. If all cleanup is left to the stop notification, this path is not handled.

The stop notifications are SERVICE_CONTROL_SHUTDOWN / SERVICE_CONTROL_PRESHUTDOWN. This handling is needed for restart and full shutdown, so do not remove it. Keep it, and in addition perform cleanup and reconnection on the power events for the transition to sleep or hibernation and the resume from them.²⁵

Neither notification is delivered except to services that made the corresponding acceptance declaration. Without the declaration, the service is terminated without notice at stop time, and hibernated and restored without notice in a hybrid shutdown. What gets started again in the boot after a full shutdown is services whose start type is Automatic. Manual and Disabled services do not come back without a dependency, a trigger, or an explicit start. How to receive power events in practice is covered in “Apps That Break on Resume from Sleep”.²⁴

7.5 Drivers Can Distinguish Fast Startup from a Normal Resume from Hibernation

Drivers can tell the two apart using the SYSTEM_POWER_STATE_CONTEXT included in the system set-power IRP.⁵

The system-supplied NDIS driver uses this difference: it disables the miniport’s wake capability for Fast Startup and does not disable it for a resume from a normal hibernation. This is the reason, explained in 4.4, why WOL is handled differently even though both are S4.⁵

Microsoft’s guidance is also that drivers which configure a device differently on a cold boot and on a resume from hibernation should configure it as for a cold boot after Fast Startup.⁵

8. Reflecting This in Procedures and Monitoring

Once the mechanism is understood, align the operations and wording used on site.

Stating “restart” explicitly is also important for preventing forced power-offs by long-pressing the power button on site. Uptime-based monitoring can be used as is. On a Fast Startup machine, it is correctly detecting that the kernel has not been restarted.

Even when a restart makes a problem disappear, obtain the reproduction check and log corroboration from 4.1 before reflecting it in procedures or settings. If a restart does not fix it, pursue causes other than Fast Startup. See also “Windows Shutdown as Seen from Your App” for the relationship between updates and device-PC apps.³

9. Summary

The point to remember is that a “shutdown” with Fast Startup enabled is a power-off from the user’s point of view, not an operation that rebuilds all of Windows’ state. Apps and the user session are closed, but the kernel, drivers, and Session 0 services are saved and restored.⁵²

On a PC with Fast Startup turned off, or with no hibernation file, a normal “Shut down” also closes the kernel session and enters S5.

To reset once, choose Restart; to terminate completely and also cut the power, choose shutdown /s /t 0. Do not conclude the cause just because a restart fixed it; corroborate with a reproduction check, Event 27, and the surrounding logs.¹⁹

Whether to turn Fast Startup off is decided by whether the machine assumes initialization and whether another OS modifies the same volume. For the latter, countermeasures for explicit hibernation are also needed. If WOL is the goal, reconsider the standby state rather than toggling the setting.¹⁷²⁰⁴

Related Articles

• Windows Shutdown as Seen from Your App — Surviving Exit Notifications, Restarts, and Power Loss Correctly
• Apps That Break on Resume from Sleep — How Windows Power Events Work and How to Build Business Apps That Survive Them
• Sleep, Hibernation, Modern Standby, and Long-Running Apps — Designing Around ‘It Stopped Overnight’
• What Is Windows Efficiency Mode? - The Green Leaf Icon and How to Turn It Off
• A Guide to Windows NIC Advanced Settings - RSS/LSO/EEE/Wake on LAN
• Windows Update Management After WSUS Deprecation — How to Choose Between WUfB, Autopatch, and Intune
• Which Windows Should You Put on an Industrial PC? — A Practical Guide to Windows IoT Enterprise / LTSC
• How to Build and Operate Windows Services — From Choosing Between Task Scheduler and Services to Turning a BackgroundService into a Windows Service

Related Consulting Areas

KomuraSoft LLC handles the design of provisioning standards that include the power operation of device PCs and kiosk terminals (shutdown, sleep, hibernation, and Wake on LAN), root-cause investigation of long-running app problems such as “only a restart fixes it” and “it had stopped by morning”, and design review of power-event handling in Windows services and resident apps. Feel free to start from a single case such as “the uptime does not go down even though we shut down every night”.

• Windows Application Development
• Bug Investigation & Root-Cause Analysis
• Technical Consulting & Design Review
• Contact Us

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

A problem that a 'shutdown' did not fix went away after a 'restart'. Why?

On Windows 8 and later client versions, a 'shutdown' in a configuration where Fast Startup is enabled (the default on most PCs that support hibernation) is a hybrid shutdown. The user is signed out, but the state of the kernel, drivers, and services is saved to the hibernation file (hiberfil.sys) and restored as is on the next boot. In other words, the core of the OS has not been reset. A 'restart', by contrast, always performs a full boot cycle regardless of the Fast Startup setting, so bad state in drivers and services is reset. However, the fact that a restart fixed it does not by itself confirm the cause. An intermittent problem may simply not have reproduced, or the restart may have fixed things by completing a pending update. Confirm several times that 'it reproduces after a shutdown and does not reproduce after a restart', corroborate with Kernel-Boot Event 27 in the System log showing that the most recent boot was 0x1 (Fast Startup) and with driver-side records, and only then treat the carried-over state as the cause. When isolating a problem, use 'restart', not 'turn it off and on again'.

The uptime in Task Manager has not reset for days. Is something broken?

The uptime counter itself is working correctly. If you 'shut down' every night and the uptime keeps growing, it is most likely the specified behavior of Fast Startup (hybrid shutdown), but a shutdown that failed and did not complete looks the same, so do not conclude 'nothing is broken' until you have checked Event 27 and the surrounding log entries described below. Uptime is the elapsed time since the kernel booted, and in a hybrid shutdown the kernel is only hibernated and restored, so the counter keeps running. Microsoft's documentation also states explicitly that on a user-initiated shutdown the kernel, drivers, and services are saved and restored rather than restarted, so the uptime between kernel restarts can be significantly longer than on earlier versions of Windows. Uptime is also preserved across a resume from sleep or hibernation and across a shutdown that did not complete, so to be certain, confirm with Kernel-Boot Event 27 in the System log that the type of the most recent boot was 0x1 (Fast Startup). To reset the uptime, choose 'Restart' or perform a full shutdown with shutdown /s /t 0.

Should I turn Fast Startup off?

Not across the board. Microsoft does not recommend disabling Fast Startup, and on an ordinary laptop the faster boot outweighs the downsides. Turning it off is worthwhile on machines operated on the assumption that 'powering off initializes everything', such as device PCs and test machines, in dual-boot environments that share the same disk with another OS, and on test machines that boot from another OS and modify the volume (in that case, turning off Fast Startup alone leaves explicit hibernation available, so also disable hibernation with powercfg /h off, or require a full shutdown before switching OS in the procedure). If the goal is to free disk space, turning Fast Startup off does not delete the hibernation file (hiberfil.sys), so it will not achieve that. To shrink the hibernation file while keeping Fast Startup, use powercfg /h /type reduced; if you do not need hibernation at all, use powercfg /h off. If you simply 'want to reset once', a restart or shutdown /s /t 0 does the job without changing any setting.

I cannot wake a shut-down PC with Wake on LAN.

On Windows 10/11, Wake on LAN is not supported from either the default shutdown (hybrid shutdown) or a full shutdown (S5). Because a state in which the user ordered a shutdown is expected to consume zero power, Windows does not arm the network adapter for wake. Wake on LAN is available from sleep (S3) or when the user explicitly chose hibernation (S4). A hybrid shutdown is also S4 in reality, but Windows explicitly disables Wake on LAN only on the transition to a hybrid shutdown. For a machine you want to wake overnight for updates, operate it in 'Sleep' or 'Hibernate' rather than 'Shut down', or check the firmware's wake features. On Modern Standby (S0 low-power idle) machines, which have no S3, the network can be a wake source even during sleep, but whether the machine can actually be woken depends on the NIC, firmware, power conditions, and the OEM's implementation, so verify on the real machine before building it into operations.

I chose 'Update and shut down' in Windows Update, but the update is still not finished at the next boot.

Microsoft's support documentation states explicitly that some updates can complete only in a boot that follows a full shutdown, and may not complete when the boot goes through Fast Startup (hibernation). When you want an update to finish for certain, choose 'Update and restart'. In environments managed by Configuration Manager, this delay was improved in Configuration Manager 2002 and Windows 10 21H1.

Our in-house business app calls shutdown. Which API gives a full shutdown?

InitiateSystemShutdownEx and InitiateSystemShutdown never become hybrid: with bRebootAfterShutdown set to FALSE they power off (full shutdown), and with TRUE they restart. InitiateShutdown performs a shutdown for Fast Startup only when the SHUTDOWN_HYBRID flag is combined with SHUTDOWN_POWEROFF (combined with SHUTDOWN_RESTART it restarts, and SHUTDOWN_NOREBOOT only stops the system without powering off), and ExitWindowsEx only when EWX_HYBRID_SHUTDOWN is combined with EWX_SHUTDOWN (EWX_HYBRID_SHUTDOWN is not specified alone). If your app implements the 'power off' button of a device PC, call InitiateSystemShutdownEx with bRebootAfterShutdown = FALSE, or call ExitWindowsEx with EWX_POWEROFF only (no EWX_HYBRID_SHUTDOWN; EWX_SHUTDOWN only stops the system to a point where the power can be safely turned off and does not power off), and you get a full shutdown regardless of the setting (both assume the SE_SHUTDOWN_NAME privilege has been enabled with AdjustTokenPrivileges: ExitWindowsEx on the process token, InitiateSystemShutdownEx on the calling thread's effective token; if it is left disabled the call fails). From the command line, shutdown /s /t 0 is a full shutdown by default and becomes hybrid only when /hybrid is added.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.