{
	"id": "c5712bf0-0fd6-4743-876d-f9f8e94c704e",
	"created_at": "2026-04-06T00:21:29.567012Z",
	"updated_at": "2026-04-10T13:12:34.071561Z",
	"deleted_at": null,
	"sha1_hash": "e29e8a8652ba5fd10d50390f59104d155450c924",
	"title": "shutdown",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 70072,
	"plain_text": "shutdown\r\nBy robinharwood\r\nArchived: 2026-04-05 23:46:04 UTC\r\nEnables you to shut down or restart local or remote computers, one at a time.\r\nshutdown [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/fw] [/f] [/m \\\\computer][/t xxx][/\r\nParameter Description\r\n/i\r\nDisplays the Remote Shutdown box. The /i option must be the first parameter\r\nfollowing the command. If /i is specified, all other options are ignored.\r\n/l\r\nSigns out the current user immediately with no time-out period. The /l parameter works\r\nindependently and can't be combined with any other parameters. Attempts to combine /l\r\nwith any other parameter is ignored.\r\n/s Shuts down the computer.\r\n/sg\r\nShuts down the computer. On the next boot, if Automatic Restart Sign-On is enabled,\r\nthe device automatically signs in and locks based on the last interactive user. After sign\r\nin, it restarts any registered applications.\r\n/r Restarts the computer after shutdown.\r\n/g\r\nFully shuts down and restarts the computer. On restart, if Automatic Restart Sign-On\r\nis enabled, the device automatically signs in and locks based on the last interactive user.\r\nAfter sign in, it restarts any registered applications.\r\n/a\r\nAborts a pending system shutdown. This must be run as a separate command in a new\r\ncommand prompt window during the time-out period (for example, shutdown /a ).\r\nCombine with /fw to clear any pending boots to firmware.\r\n/p\r\nTurns off the local computer only (not a remote computer) with no time-out period or\r\nwarning. You can use /p only with /d or /f. If your computer doesn't support power-off\r\nfunctionality, it shuts down when you use /p, but the power to the computer remains on.\r\n/h\r\nPuts the local computer into hibernation, if hibernation is enabled. The /f switch can be\r\nused with the /h switch.\r\n/hybrid\r\nShuts down the device and prepares it for fast startup. This option must be used with\r\nthe /s option.\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown\r\nPage 1 of 5\n\nParameter Description\r\n/fw\r\nCombining this option with a shutdown option causes the next restart to go to the\r\nfirmware user interface.\r\n/e\r\nEnables you to document the reason for an unexpected shutdown of a computer in the\r\nShutdown Event Tracker.\r\n/o\r\nGoes to the Advanced boot options menu and restarts the device. This option must be\r\nused with the /r option.\r\n/f\r\nForces running applications to close without warning users.\r\nCaution: Using the /f option might result in loss of unsaved data.\r\n/m \\\\\r\n\u003ccomputername\u003e\r\nSpecifies the target computer.\r\n/t \u003cxxx\u003e\r\nSets the time-out period before shutdown to xxx seconds. The valid range is 0-\r\n315360000 (10 years), with a default of 30. If the timeout period is greater than 0, the /f\r\nparameter is implied.\r\n/d [p \\| u:]\r\n\u003cxx\u003e:\u003cyy\u003e\r\nLists the reason for the system restart or shutdown. The supported parameter values are:\r\nP - Indicates that the restart or shutdown is planned.\r\nU - Indicates that the reason is user-defined.\r\nIf p or u aren't specified, the restart or shutdown is unplanned.\r\nxx - Specifies the major reason number (a positive integer, less than 256).\r\nyy Specifies the minor reason number (a positive integer, less than 65536).\r\n/c \u003ccomment\u003e\r\nEnables you to create a custom reason for the system shutdown or restart, which must\r\nbe enclosed in double quotation marks. You can use a maximum of 512 characters. Can\r\nalso be used with the /d parameter.\r\n/?\r\nDisplays help at the command prompt, including a list of the major and minor reasons\r\nthat are defined on your local computer.\r\nUsers must be assigned the Shut down the system user right to shut down a local or remotely administered\r\ncomputer that is using the shutdown command.\r\nUsers must be members of the Administrators group to annotate an unexpected shutdown of a local or\r\nremotely administered computer. If the target computer is joined to a domain, members of the Domain\r\nAdmins group might be able to perform this procedure. For more information, see:\r\nDefault local groups\r\nDefault groups\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown\r\nPage 2 of 5\n\nIf you want to shut down more than one computer at a time, you can call shutdown for each computer by\r\nusing a script, or you can use shutdown /i to display the Remote Shutdown box.\r\nIf you specify major and minor reason codes, you must first define these reason codes on each computer\r\nwhere you plan to use the reasons. If the reason codes aren't defined on the target computer, Shutdown\r\nEvent Tracker can't log the correct reason text.\r\nRemember to indicate that a shutdown is planned by using /d p|u:xx:yy , where xx and yy represent\r\nthe major and minor reason codes. Not using the /d parameter might cause the shutdown to be logged\r\nwithout a specified reason. Using the /d parameter for an unplanned shutdown allows the shutdown to be\r\nlogged correctly.\r\nThe shutdown or restart reasons uses the following legend:\r\nE: Expected - An expected shutdown or restart that is planned and communicated in advance.\r\nU: Unexpected - An unexpected shutdown or restart occurs where the system stops working due to an error,\r\nsuch as a system crash, power failure or other.\r\nP: Planned - A planned shutdown or restart scheduled in advance, such as system maintenance, software\r\ninstallation or other.\r\nC: Customer Defined - Specify a custom reason for the system shutdown or restart.\r\nReason type Major Minor Description\r\nU 0 0 Other (Unplanned)\r\nE 0 0 Other (Unplanned)\r\nE or P 0 0 Other (Planned)\r\nU 0 5 Other Failure: System Unresponsive\r\nE 1 1 Hardware: Maintenance (Unplanned)\r\nE or P 1 1 Hardware: Maintenance (Planned)\r\nE 1 2 Hardware: Installation (Unplanned)\r\nE or P 1 2 Hardware: Installation (Planned)\r\nE 2 2 Operating System: Recovery (Unplanned)\r\nE or P 2 2 Operating System: Recovery (Planned)\r\nP 2 3 Operating System: Upgrade (Planned)\r\nE 2 4 Operating System: Reconfiguration (Unplanned)\r\nE or P 2 4 Operating System: Reconfiguration (Planned)\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown\r\nPage 3 of 5\n\nReason type Major Minor Description\r\nP 2 16 Operating System: Service pack (Planned)\r\n2 17 Operating System: Hot fix (Unplanned)\r\nP 2 17 Operating System: Hot fix (Planned)\r\n2 18 Operating System: Security fix (Unplanned)\r\nP 2 18 Operating System: Security fix (Planned)\r\nE 4 1 Application: Maintenance (Unplanned)\r\nE or P 4 1 Application: Maintenance (Planned)\r\nE or P 4 2 Application: Installation (Planned)\r\nE 4 5 Application: Unresponsive\r\nE 4 6 Application: Unstable\r\nU 5 15 System Failure: Stop error\r\nU 5 19 Security issue (Unplanned)\r\nE 5 19 Security issue (Unplanned)\r\nE or P 5 19 Security issue (Planned)\r\nE 5 20 Loss of network connectivity (Unplanned)\r\nU 6 11 Power Failure: Cord Unplugged\r\nU 6 12 Power Failure: Environment\r\nP 7 0 Legacy API shutdown\r\nTo force apps to close and to restart the local computer after a one-minute delay, with the reason Application:\r\nMaintenance (Planned) and the comment \"Reconfiguring myapp.exe\", type:\r\nshutdown /r /t 60 /c \"Reconfiguring myapp.exe\" /f /d p:4:1\r\nTo perform a planned shutdown of a device in 10 minutes and capture the reason in the shutdown event tracker\r\nwith the comment \"Scheduled maintenance\", type:\r\nshutdown.exe /s /t 600 /d p:0:0 /e /c \"Scheduled maintenance\"\r\nTo restart the remote computer myremoteserver with the same parameters as the previous example, type:\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown\r\nPage 4 of 5\n\nshutdown /r /m \\\\myremoteserver /t 60 /c \"Reconfiguring myapp.exe\" /f /d p:4:1\r\nTo restart the remote computer myremoteserver in 5 minutes due to a security update and include a custom reason\r\nin the shutdown event tracker, type:\r\nshutdown /r /t 300 /e /c \"Security Update\" /m \\\\myremoteserver\r\nTo cancel a pending shutdown (must be run in a new command prompt window during the timeout period), type:\r\nshutdown /a\r\nCommand-Line Syntax Key\r\nSource: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown"
	],
	"report_names": [
		"shutdown"
	],
	"threat_actors": [],
	"ts_created_at": 1775434889,
	"ts_updated_at": 1775826754,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e29e8a8652ba5fd10d50390f59104d155450c924.pdf",
		"text": "https://archive.orkl.eu/e29e8a8652ba5fd10d50390f59104d155450c924.txt",
		"img": "https://archive.orkl.eu/e29e8a8652ba5fd10d50390f59104d155450c924.jpg"
	}
}