Grab our RSS feeds Follow us on Twitter Join our Facebook Group Connect with us on LinkedIn
myITforum.com, Powered by You.
you are not logged in

Articles

Newslinks

Links

Downloads

Site Services

Community Forums

Discussion Lists

Article Search

Newsletter

Web Blogs

FAQs

Live Support

myITforum TV

Take a Poll

Monthly Drawing

myITforum Network

User Group Directory

Our Partners

About Us

Register

Login

BRONZE PARTNER:

BRONZE PARTNER:



Industry News:




  Home : Articles : Altiris print | email | | Forums |   print | email | | Blogs |   print | email | | Wiki |   print | email | | FAQs |   print | email | Article Search  
Windows XP Shutdown Utility Reason Codes


Bookmark and Share

By: Aaron Czechowski
Posted On: 3/21/2006

This article assumes a basic knowledge of the Windows XP Shutdown utility. For more information on the Shutdown utility see Shutdown.exe Comes with Windows XP.

While the Shutdown utility has the ability to log system-defined reasons for shutdown (passing major and minor reason codes as command line parameters) there is little to no documentation on which code combinations actually produce an event description other than the default, "No title for this reason could be found."

Microsoft MSDN has an article on System Shutdown Reason Codes that documents all of the system-defined codes (as well as how to create custom user-defined codes), but it only provides the text variables for developers, not the numerical equivalents which are required as parameters for the Shutdown utility. The numerical equivalents are defined in reason.h, a header file that comes with Visual Studio .NET, and are summarized at the end of this document.

Even with eight major system-defined codes and 28 minor codes, there are actually only 18 combinations that Windows XP recognizes:
Plan?	Major	Minor	Reason Description 
No 0 0 Other (Unplanned)
Yes 0 0 Other (Planned)
No 0 5 Other Failure: System Unresponsive
No 1 1 Hardware: Maintenance (Unplanned)
Yes 1 1 Hardware: Maintenance (Planned)
No 1 2 Hardware: Installation (Unplanned)
Yes 1 2 Hardware: Installation (Planned)
No 2 3 Operating System: Upgrade (Unplanned)
Yes 2 3 Operating System: Upgrade (Planned)
No 2 4 Operating System: Reconfiguration (Unplanned)
Yes 2 4 Operating System: Reconfiguration (Planned)
No 4 1 Application: Maintenance (Unplanned)
Yes 4 1 Application: Maintenance (Planned)
No 4 5 Application: Unresponsive
No 4 6 Application: Unstable
No 5 15 System Failure: Stop error
No 6 11 Power Failure: Cord Unplugged
No 6 12 Power Failure: Environment

The first column determines whether the p flag is used before the reason codes, e.g.:
Command line		Reason Description
shutdown.exe -d p:4:1 Application: Maintenance (Planned)
shutdown.exe -d :4:1 Application: Maintenance (Unplanned)

(NOTE: "Planned" vs "Unplanned" is in respect to the shutdown not the reason. In other words, it might be hard to imagine an unplanned hardware installation, but not an unplanned shutdown because of the installation of new hardware.)


Event Log Entry Example

The command
shutdown.exe -r -t 5 -c "Restarting to finalize setup" -f -d p:2:4

produces the following entry in the System Event Log:

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 6/4/2004
Time: 10:06:58 AM
User: NT AUTHORITY\SYSTEM
Computer: XPTEST
Description:
The process winlogon.exe has initiated the restart of XPTEST for the following reason: Operating System: Reconfiguration (Planned)
Minor Reason: 0x4
Shutdown Type: reboot
Comment: Restarting to finalize setup

Data:
0000: 80020004

(NOTE: The value in the Data section is the hexidecimal code computed by adding all of the flags as defined in reason.h.)


Prompting Users

Windows XP by default does not prompt users to give a reason when shutting down manually. This functionality is enabled via the registry:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability
Name: ShutdownReasonUI
Type: REG_DWORD
Data: 0 = default (disabled), 1 = enabled



Reason Code Table
Reason Name				Hex Code	Dec Code 
SHTDN_REASON_MAJOR_OTHER 0x00000000 0
SHTDN_REASON_MAJOR_NONE 0x00000000 0
SHTDN_REASON_MAJOR_HARDWARE 0x00010000 1
SHTDN_REASON_MAJOR_OPERATINGSYSTEM 0x00020000 2
SHTDN_REASON_MAJOR_SOFTWARE 0x00030000 3
SHTDN_REASON_MAJOR_APPLICATION 0x00040000 4
SHTDN_REASON_MAJOR_SYSTEM 0x00050000 5
SHTDN_REASON_MAJOR_POWER 0x00060000 6
SHTDN_REASON_MAJOR_LEGACY_API 0x00070000 7
SHTDN_REASON_MINOR_OTHER 0x00000000 0
SHTDN_REASON_MINOR_NONE 0x000000ff 255
SHTDN_REASON_MINOR_MAINTENANCE 0x00000001 1
SHTDN_REASON_MINOR_INSTALLATION 0x00000002 2
SHTDN_REASON_MINOR_UPGRADE 0x00000003 3
SHTDN_REASON_MINOR_RECONFIG 0x00000004 4
SHTDN_REASON_MINOR_HUNG 0x00000005 5
SHTDN_REASON_MINOR_UNSTABLE 0x00000006 6
SHTDN_REASON_MINOR_DISK 0x00000007 7
SHTDN_REASON_MINOR_PROCESSOR 0x00000008 8
SHTDN_REASON_MINOR_NETWORKCARD 0x00000009 9
SHTDN_REASON_MINOR_POWER_SUPPLY 0x0000000a 10
SHTDN_REASON_MINOR_CORDUNPLUGGED 0x0000000b 11
SHTDN_REASON_MINOR_ENVIRONMENT 0x0000000c 12
SHTDN_REASON_MINOR_HARDWARE_DRIVER 0x0000000d 13
SHTDN_REASON_MINOR_OTHERDRIVER 0x0000000e 14
SHTDN_REASON_MINOR_BLUESCREEN 0x0000000F 15
SHTDN_REASON_MINOR_SERVICEPACK 0x00000010 16
SHTDN_REASON_MINOR_HOTFIX 0x00000011 17
SHTDN_REASON_MINOR_SECURITYFIX 0x00000012 18
SHTDN_REASON_MINOR_SECURITY 0x00000013 19
SHTDN_REASON_MINOR_NETWORK_CONNECTIVITY 0x00000014 20
SHTDN_REASON_MINOR_WMI 0x00000015 21
SHTDN_REASON_MINOR_SERVICEPACK_UNINSTALL 0x00000016 22
SHTDN_REASON_MINOR_HOTFIX_UNINSTALL 0x00000017 23
SHTDN_REASON_MINOR_SECURITYFIX_UNINSTALL 0x00000018 24
SHTDN_REASON_MINOR_MMC 0x00000019 25
SHTDN_REASON_MINOR_TERMSRV 0x00000020 32
SHTDN_REASON_FLAG_PLANNED 0x80000000 8
SHTDN_REASON_FLAG_UNPLANNED 0x00000000 0
SHTDN_REASON_FLAG_USER_DEFINED 0x40000000 4

Questions/comments? Let me know: aaronczechowski@gmail.com

  myITforum.com ©2010 | Legal | Privacy