What is the sequence of events on Windows shutdown?

Question

When a user shuts down normally via the Start menu on a domain joined computer, what happens first, a) attempt to close apps running in the background or b) disconnect from the server?

The reason I ask is that we run a small portable app on a server share when the user logs in.

On shutdown, normal behavior by all but a tiny number of users is that the app terminates silently (it intercepts the Windows shutdown signal and ends) and the PC shutdown continues normally.

For a few, it's obvious to me that the network connection is terminated and Windows throws a message box with 0xc00000c4, STATUS_UNEXPECTED_NETWORK_ERROR, because the app can't shut itself down as it "doesn't exist", as it sees it.

So, it there a set sequence of events, or is it, um, who knows what and when in which order?

Answer 1

During shutdown, Windows just sends a close message to everything that is running. Processes and services that don't finish within a given timeout may either be forcefully terminated, or the user might be prompted for a decision.

As shutdown is done in parallel, there is no ordered sequence of events. The order depends on the time it takes each process to terminate, and may be further influenced by hardware performance.

To ensure your program terminates before that happens, you could create a shutdown script that will close it in an orderly manner. Use the Group Policy Editor (gpedit.msc) and go to Computer Configuration > Windows Settings > Scripts (Startup/Shutdown).