Fix Windows 10/11 Slow Shutdown or Restart: Find and Disable Hang Apps (Event Viewer)
Difficulty: Intermediate |
Time Required: 20 minutes
Slow shutdowns and restarts are usually caused by one (or a few) apps/services that don’t close when Windows tells them to. Instead of guessing, you can
prove what’s delaying power-off by checking
Event Viewer for “hang” events and then taking targeted action: updating, uninstalling, disabling auto-start, or adjusting shutdown behavior.
This tutorial shows how to identify the culprits and fix them safely on
Windows 10 and Windows 11.
Prerequisites
- Windows 10 or Windows 11 (any edition)
- An account with Administrator access (recommended for some steps)
- Optional but helpful:
- A few recent slow shutdown/restart occurrences (so events exist to review)
- Basic familiarity with Task Manager and startup apps
Step-by-step: Find the app(s) delaying shutdown/restart using Event Viewer
1) Reproduce the slow shutdown (optional but recommended)
If the issue is intermittent, it helps to create a fresh event log entry.
- Save your work and close as many programs as possible.
- Click Start → Power → Shut down (or Restart).
- If it hangs noticeably (e.g., 30–120+ seconds), that’s the incident we’ll investigate.
- Power back on and sign in.
Note: If the machine is truly stuck for many minutes, avoid hard power-offs unless necessary—forced power cuts can corrupt files or updates.
2) Open Event Viewer
- Right-click Start.
- Select Event Viewer.
- Alternatively press Win + R, type
eventvwr.msc, press Enter.
3) Navigate to the most useful shutdown logs
We’ll check two locations, because Windows can record “hang” behavior in different channels.
Option A (common): System log
- In the left pane, expand Windows Logs.
- Click System.
Option B (often best detail): Diagnostics Performance log
- In the left pane, expand:
Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance
- Click Operational.
Tip: The Diagnostics-Performance “Operational” log often gives clearer “this took X ms” shutdown timing details.
4) Filter for shutdown/restart performance events
In Diagnostics-Performance → Operational
- In the right pane, click Filter Current Log…
- In Event IDs, enter:
- 200 (shutdown performance)
- 201/202/203 (shutdown-related details; varies by build)
- 100 (boot performance; optional for restart issues)
- Click OK.
Now you’ll see entries that correspond to slow shutdowns and what contributed to them.
In Windows Logs → System
- Click Filter Current Log…
- In Event sources, look for entries like:
- User32
- Service Control Manager
- (Sometimes) Application Hang will appear in other logs, but System can still provide hints.
- Click OK.
5) Identify “hang apps” and “hang services”
Now open events around the time you last shut down.
- Sort by the Date and Time column (descending).
- Double-click events around the slow shutdown.
- Read the General tab carefully—look for:
- An app name (EXE) such as
SomeApp.exe
- A service name
- Phrases like “This application took too long to shut down” or “shutdown time was…”
What you’re looking for:
- A specific process name (example:
Teams.exe, Photoshop.exe, OneDrive.exe)
- A specific service (example: a backup agent, printer service, RGB utility, VPN service)
Tip: Keep a short list. It’s common to find 1–3 repeat offenders, not dozens.
6) Correlate with Reliability Monitor (quick confirmation)
Reliability Monitor presents crashes/hangs in a readable timeline and can confirm patterns.
- Press Win, type Reliability Monitor, open View reliability history.
- Look at the day/time of the slow shutdown.
- Check for:
- Application Hang
- Windows was not properly shut down
- Repeat failures tied to a specific app
Note: Reliability Monitor is especially helpful if Event Viewer lists an EXE name you don’t recognize—you can often click the entry and see more context.
Step-by-step: Fix the culprit (disable, update, or reconfigure)
Once you have a suspect app/service, use the least invasive fix first.
7) Stop the app from auto-starting (common fix)
Many shutdown delays come from background tray apps that don’t exit properly.
Windows 10/11:
- Press Ctrl + Shift + Esc to open Task Manager.
- Click Startup (Windows 10) or Startup apps (Windows 11 may show this differently).
- Find the suspect app (match by name/publisher).
- Right-click → Disable.
- Reboot and test shutdown again.
Tip: If you’re unsure, disable one suspect at a time so you can measure the impact.
8) Update or reinstall the app (often the real solution)
If Event Viewer repeatedly blames a legitimate program you need:
- Update the app from its built-in updater or the publisher’s site.
- If already up to date, try:
- Settings → Apps → Installed apps (Windows 11) / Apps & features (Windows 10)
- Select the app → Modify (if available) → Repair
- Or Uninstall, reboot, then reinstall the latest version
Warning: Avoid third-party “driver updater” tools. Use the vendor site, Microsoft Store, or Windows Update where appropriate.
9) If it’s a service: test disabling it safely
If Diagnostics-Performance/System points to a service:
- Press Win + R, type
services.msc, press Enter.
- Locate the suspected service (by name).
- Double-click it → set Startup type to Manual (safer than Disabled for first test).
- Click Stop (if it’s running), then OK.
- Test shutdown/restart.
Note: For security software, backups, VPNs, printer suites, RGB utilities, and OEM “helper” tools, services are frequent offenders.
Warning: Don’t disable core Microsoft services or anything you’re unsure about. If the service name is unclear, search the exact service name online first or ask on the forum.
10) Optional: Adjust Windows “Wait to kill app” behavior (advanced)
Windows has built-in timeouts that control how long it waits for apps/services to exit. Tweaking these can reduce waiting—but it can also increase the risk of data loss if apps are forced closed too quickly.
If you want to proceed, do so carefully and back up first:
- Press Win + R, type
regedit, press Enter.
- (Recommended) Create a restore point first:
- Press Win, type Create a restore point → Create
- Navigate to:
HKEY_CURRENT_USER\Control Panel\Desktop
- Look for these values (may or may not exist):
WaitToKillAppTimeoutHungAppTimeout
- If you change anything, note the original values and restart Windows.
Warning: Lowering timeouts too aggressively can force-close apps and cause unsaved work loss or file corruption. For most users, fixing the actual hang app is better than reducing timeouts.
Tips and troubleshooting notes
- Test after each change. The easiest way to know you fixed it is to repeat shutdown/restart and re-check Event Viewer.
- Look for patterns. If shutdown is only slow after gaming, printing, syncing, or VPN use, focus on those apps/services.
- Fast Startup (Windows 10/11) and “restart vs shutdown.” Fast Startup affects shutdown behavior (hybrid shutdown). If shutdown is slow but restart is fine, consider testing with Fast Startup off:
- Control Panel → Power Options → Choose what the power buttons do → Change settings that are currently unavailable → uncheck Turn on fast startup
- Updates stuck or pending. If Windows is “Working on updates” during shutdown, that’s a different issue than hang apps. Check Settings → Windows Update and let updates finish.
- If Event Viewer is empty or unclear:
- Make sure you’re looking at the right timeframe.
- Use Diagnostics-Performance → Operational first.
- Use Reliability Monitor as a backup source of truth.
Conclusion
By using
Event Viewer (and optionally
Reliability Monitor) you can stop guessing and identify exactly which apps or services are delaying shutdown or restart. Disabling the offending startup item, updating/reinstalling the app, or adjusting a problematic service usually restores normal shutdown times—often from minutes back to seconds.
Key Takeaways:
- Use Diagnostics-Performance → Operational to pinpoint shutdown delays and repeat offenders.
- Disable or update the specific hang app instead of applying random “speed-up” tweaks.
- Change services and shutdown timeouts carefully—fix the cause first, then tune behavior if needed.
This tutorial was generated to help WindowsForum.com users get the most out of their Windows experience.