Windows 8 - Nothing happens when you initiate a shutdown or hangs at the “shutting down” donut.

On my corporate machine I had the issue where Windows would either:

1. Endlessly show the “Shutting Down” screen.
   OR   
2. When initiating a shutdown, nothing would happen except that Winlogon.exe would take a 100% CPU utilization on a single core.

I realized that when I didn’t use a hibernate file (powercfg /h off) scenario 2 would happen.

 

Troubleshooting the first scenario:

When troubleshooting the first scenario I configured the registry keys as described in “Windows feature lets you generate a memory dump file by using the keyboard” as can be found here. In order to get a full memory.dmp I configured the registry like described in KB254649.
After that I initiated a shutdown and waited for a few minutes before creating a memory dump by holding down the right CTRL key and pressing the SCROLL LOCK key two times.

 

After rebooting the machine there was a file C:\Windows\Memory.dmp ready to be analyzed in the Windows Debugger. The interesting stack (thanks Rob Scheepens) turned out to be:

…
  |    |    WINLOGON.EXE!ShutdownWindowsWorkerThread
  |    |    |- WINLOGON.EXE!IsHiberboot
  |    |    |    |- FMIFS.DLL!QueryIsDiskCheckScheduledForNextBoot
  |    |    |    |    |- FMIFS.DLL!QueryIsDiskCheckScheduledForNextBoot
  |    |    |    |    |    |- FMIFS.DLL!InvokeAutoChk
  |    |    |    |    |    |    |- IFSUtil.DLL!IFS_SYSTEM::QueryCorruptionState
…

I wasn’t sure why it was checking whether CHKDSK was scheduled for a next boot. 

      

Troubleshooting the second scenario:

Since I also noticed the “IsHiberboot” part in the stack of the previous scenario, I enabled my hibernation file to check if this was to blame (using “Powercfg /h on").

After initiating a shutdown, nothing would happen except that winlogon.exe would take a 100% usage on a single core. After giving my PC a cold-reset I troubleshooting this using the following steps:

Note: If you don’t have the Windows 8 Performance Recorder installed, consult my previous blog for instructions:

https://blogs.technet.com/b/home_is_where_i_lay_my_head/archive/2012/07/30/how-to-install-the-windows-8-performance-recorder.aspx

I started Windows Performance Recorder, pressed Start and initiated a shutdown, waited a few minutes and finally pressed Save.  

The result was a .ETL file which I loaded in Windows Performance Analyzer.
We already know the problem is related to the process winlogon.exe as shown in Task Manager, so we need symbols to get more information. To configure this use “Trace/Configure Symbol Path” and entered the Microsoft Public Symbol path:

Now looking at the trace, we can confirm it’s winlogon.exe taking a 100% CPU usage on a single core:

 

Zooming in on the responsible thread and doing some stackwalking, the same stack was to blame:

 

Because the stack is identical to problem troubleshooted in scenario 1, we can confirm it’s the same issue.

So what do we do next?

The thing I didn’t understand was the QueryIsDiskCheckScheduledForNextBoot part.
I looked in my registry to see if any CheckDisks (chkdsk) was scheduled and found this entry:

HKLM\System\CurrentControlSet\Control\Session Manager

I searched the registry for HarddiskVolume7 but couldn’t find any other entry and realized this was a VHD that was mounted a while ago.   

Turned out to be that in the past:

• I mounted a VHD
• The volume got the dirty bit set
• Before rebooting I dismounted the VHD again.

I followed up with the developers responsible for this code, turns out there might be a bug in autochk where it is not properly handling an explicit request to check a volume that no longer exists. This is currently being investigated.

The workaround is simple, remove this line from BootExecute:

autocheck autochk /m /f \Device\HarddiskVolum7

If this info has helped you, please consider leaving a comment.

Comments

• Anonymous
  January 01, 2003
  Wow! This article is amazing! Thanks you very much PWigle. Very sold, detailed and step by step covering of the resolution.

• Anonymous
  January 01, 2003
  Great article !!!! It fixed my shutdown problem!

• Anonymous
  January 01, 2003
  @Darren, sounds like the same issue, if it isn't please contact me so we can grab a trace. (pwigle @ microsoft . com) Good luck!

• Anonymous
  January 01, 2003
  I've also helped to debug this in the technet forums: social.technet.microsoft.com/.../e7c4e2de-e1d0-43f2-a9a7-b555c5106bd5 Please create a KB article about this.

• Anonymous
  December 14, 2012
  I would just like to thank you. I had the same problem with one of my drives and I stumbled upon this blog. It saved my bacon to say the least. Sadly I lost two hours of sleep (2pm at the moment) because of this Win8 stupidity,

• Anonymous
  January 02, 2013
  YES! This was exactly the way to fix my computer! I was starting to get worried about having to format my PC after just finished to get things the way I like. Thank you very much!

• Anonymous
  January 27, 2013
  Thanks!!

• Anonymous
  January 30, 2013
  Great - looked for over an hour to find a fix - this exactly did it! Thanks!

• Anonymous
  April 21, 2013
  Awesome, worked here too. Thanks for sharing!

• Anonymous
  June 04, 2013
  I'm having a problem with the winlogon.exe task gobbling up to 25% usage of my quad-core i7-920 after I've pressed Ctrl-Alt-Del to bring up the Lock screen on Windows 8 Pro 64-bit. This then prevents my PC from restarting or shutting down, forcing me to have to use the Reset button on the case. I thought it might be caused by a third-party app that I have running in the background but after reading through this very informative post, it sounds remarkably similar to the problem I'm having; 25% CPU usage is obviously 100% of one of my four cores. I will check my PC later today and hopefully this will be the fix. If so then I will report back and let you know in the hope that it will help other people who have the same problem.

• Anonymous
  June 04, 2013
  will there be a hotfix to address this issue?

• Anonymous
  June 04, 2013
  The comment has been removed

• Anonymous
  June 05, 2013
  Darren, if you can follow these steps I can analyze the trace for you: 1- Install the Windows Performance Toolkit like described here: blogs.technet.com/.../how-to-install-the-windows-8-performance-recorder.aspx 2 - Start "Windows Performance Recorder" 3 - Make sure that at "Performance Scenario" the default "General" is selected. 4 - Make sure that at "Detail Level" the default "Verbose" is selected. 5 - Hit Start < repro the issue> 6 - Hit save 7- Hit cancel to stop tracing 8 - Zip the .ETL file that has been created 9 - Put the .ETL on a location I can download it and e-mail me the link (in case you don't have a location to store the .ETL let me know via e-mail and I'll open a workspace for you). My e-mail address is pwigle @ microsoft . com (without the spaces).

• Anonymous
  June 05, 2013
  In the last few months I have been buying and installing a number of Stardock apps, starting with Start8 and then I have subsequently installed Decor8, Fences 2, WindowsFX 5.1, ObjectDock 2.0 and finally ModernMix. I believe the issue I'm having has occurred since installing those but it may just be a coincidence as I disabled all of them during testing last night and the winlogon.exe issue still occurred. Also, because they do run in Safe mode and I was still getting that issue there as well that pretty much confirms they are not the cause but I felt I'd mention them as other than games, which is the primary use for my PC, I have not installed much else in the way of apps. I'm wondering if the issue may be related to .NET Framework as I recently had problems with it when using ObjectDock but, unlike with earlier versions of Windows, there is no way to uninstall then reinstall it as it part of the operating system. Believe you me, I tried. That said, the NET Verify Tool reports that all of them are OK (from 2.0 to 4.5) but I'm not entirely convinced because I have a niggling issue with GeForce Experience not opening from the system tray icon for example (although it does open from the desktop shortcut). The current NET Repair Tool also only supports up to Windows 7 and 4.0 so is useless on Windows 8. Anyway, enough of that! I'll install WPT tonight and run the recorder before I trigger the glitch and leave it running for 20-30 seconds. Do I need to select any of More Options shown at the bottom of Windows Performance Recorder or just leave it on default?

• Anonymous
  June 05, 2013
  For some reason, the first part of my post has gone missing (it was quite a long post too!) so my existing reply looks a bit ignorant. Sorry about that. Thanks for offering to help me. I do appreciate you offering your time. I have Dropbox so I have put the zipped .ETL files in their and send you the public link to the archive, hopefully later on tonight as I'm currently as work. Thanks again.

• Anonymous
  June 05, 2013
  The comment has been removed

• Anonymous
  June 05, 2013
  @ pwigle - I will reinstall WPT tonight and send you the Dropbox link via the email address you gave me. Again, I cannot thank you enough for offering to help. Once I know what the cause is then I have a better chance of (hopefully!) resolving this extremely odd issue. Of course, if I never press Ctrl-Shift-Esc or press Ctrl-Alt-Del then select Task Manager from that Lock screen (or whatever it is called) then the winlogon.exe bug doesn't occur and I can shutdown or restart my PC normally. That's not an ideal solution though and more often than not I trigger it inadvertently because I'm so used to pressing Ctrl-Alt-Del to bring up Task Manager in Windows 7.

• Anonymous
  June 06, 2013
  @ pwigle - I emailed a zipped. ETL file to you last night so please let me know if you did not receive it. It as a 280 MB file that compressed down to about 28 MB! Again, thank you for the kind offer to help me.

• Anonymous
  July 12, 2013
  The comment has been removed

• Anonymous
  November 17, 2014
  My role has previously primarily focused on Microsoft Intune, nowadays it’s more towards our whole Enterprise