Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Shutdown Freeware

69 views
Skip to first unread message

wasbit

unread,
May 17, 2022, 5:43:32 AM5/17/22
to
Shutdown/Close/Hibernate/Suspend

Use Scheduled Task in Windows
Start / All Programs / Accessories / System Tools
XP & Vista = Scheduled Tasks
W7 = Task Scheduler

List may be out of date.

@Kill - http://www.aswit.com/akill/
AbortShutdown - http://www.coruscant.co.uk/Products/index.htm
Active Exit (log off user) - http://www.winability.com/active-exit/
Active Shutdown - http://www.snapfiles.com/get/ashutdown.html
Actual shutdown (CLi) - http://www.loonies.narod.ru/products.htm
AF1 Shutdown - http://www.fauland.com/products.htm
Airytec Switch Off - http://www.airytec.com/en/switch-off/
AutoClose - https://autoclose.net/download.html
Auto Exit (Shut down,log off,reboot) -
http://www.asoft.be/prod_autoexit.html
AutoOff - http://www.starcodec.com/en/autooff/
Auto Power Off (schedule) - http://sites.google.com/site/baliganikhil2/
Auto Reboot(uptime monitor) - http://www.summitcn.com/download.html#7
Auto Shutdown (1) - http://users.belgacom.net/rgs/index.htm
AutoShutdown (2) - http://paradiseprogramming.tripod.com/
Auto Shutdown (3) - http://www.falcoware.com/AutoShutDown.php
Auto Shutdown Timer - http://www.lullsoft.com/

BootSnooze (reboot into hybernate/standby) -
http://skwire.dcmembers.com/wb/pages/software.php
Brutus - http://www.proffs.nu/brutus.htm

Carbon Control Software HE (save energy) - http://ccspress.blogspot.co.uk/
Catfood NoSleep (CLi) - http://catfood.net/products/nosleep/
Chameleon Shutdown - http://www.chameleon-managers.com
Close - http://vuks.vdsworld.com/
Close All (taskbar) -
http://www.ntwind.com/software/utilities/close-all.html
Close All Windows - http://www.ntwind.com/software/utilities/close-all.html
Close App - http://noeld.com/updates.asp
Close Many - http://www.donationcoder.com/Software/Skrommel/index.html
Closing Time - http://leeos.tripod.com/index-14.html
CloseToQuit - http://www.donationcoder.com/Software/Skrommel/index.html
CloseWin -
http://www.freewaregenius.com/closewin-instantly-close-all-open-windows/

Daxtar's Shutdown Timer - http://sourceforge.net/projects/daxshutdown/
Delayed Shutdown - http://www.styopkin.com/delayed_shutdown.html
DirectShutdown -
http://www.softpedia.com/get/System/Launchers-Shutdown-Tools/DirectShutdown.shtml
DownTime - http://softdyn.ucoz.org/index/0-8
DownTimer - http://indeepsoft.blogspot.co.uk/p/downtimer.html
DShutdown - http://dimio.altervista.org/eng/

Enditall - http://www.docsdownloads.com/Tier1/enditall.htm
ExitWin (hpnf) -
http://www.softlow.com/windows/utilities/network/free/exitwin.html
Exit Windows (restart) - http://www.easydesksoftware.com/down.htm

Force Down -
http://www.softpedia.com/get/System/Launchers-Shutdown-Tools/HSLAB-Force-Down-Lite.shtml
Force Shutdown - http://www.vag-lab.com/blog/page/3/
Free Shutdown Timer -
http://www.sofonica.com/index.php?option=com_content&view=article&id=46&Itemid=54

GoneIn60s (recover closed apps) -
http://www.donationcoder.com/Software/Skrommel/index.html

Halt.exe - http://www.st-ware.com/page.php?30
Hibernate Switch - http://www.vag-lab.com/blog/page/2/
Hyper Shutdown - www.hypersolutions.in

Karen's Showstopper - http://www.karenware.com
Kill (window with focus) -
http://www.donationcoder.com/Software/Skrommel/index.html
Killer - http://www.spacetornado.com
Kill Win - http://www.bk-soft.com/killwin.htm
KillWin - http://www.quantrix.net/
- http://members.optusnet.com.au/quantrixnet/products/killwin.htm

Lan Shutdown - http://lantricks.com/download/
Last Chance (before shutdown) - http://www.fileware.com/products.htm
Lomsel Shutdown - http://www.lomsel.net/en/lomsel-shutdown-2/

Mz Shutdown Scheduler - http://www.mztweak.com/products.html
Nagblast -
http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/NagBlast.shtml

NoPing Shutdown - http://www.emco.is/noping/npfeatures.html
NtPower (shut via network) - http://www.santsys.com/software

PauseProcess - http://www.donationcoder.com/Software/Skrommel/index.html
PcSleep - http://www.pc-sleep.com/
PowerDown - http://www.scovetta.com/archives/simtelnet/win95/deskmisc/page-2
Powerlink (Shutdown/Restart/Hibernate) -
http://www.sdsoftware.org/default.asp?id=7042
Power Management Utilities (hibernate/suspend) -
http://officeone.mvps.org/download/power_mgmt.html
Power Off - http://users.telenet.be/jbosman/applications.html
Poweroff - http://www.ridgecrop.demon.co.uk/index.htm

Quick ShutDown - http://www.winutility.com/qsd/

Reboot - http://www.securitysoftware.cc/securitysoftware/apps.html
RemoteShutdown - http://www.coruscant.co.uk/Products/index.htm
RemShutdown - http://www.majorgeeks.com/files/details/remshutdown.html
Restart (reboot into dif OS) - http://www.gabrieleponti.com/index.html
Restart Computer (+ schedule shutdown/log off) -
http://freelabs.info/restartcomp.aspx
Restart Later - http://www.lujosoft.net/sitemap.html

Shutdown (2) - http://www.lujosoft.net/_content/_utilities/Shutdown3.html
Shutdown (3) - http://www.ericphelps.com/index.htm
Shutdown (4) - http://www.securitysoftware.cc/securitysoftware/apps.html
Shutdown8 (XP - 10) - http://www.bandicam.com/shutdown8/
Shutdown After - http://www.vcsoftwares.com/
Shutdown Centre - http://software.bootblock.co.uk/
Shutdown Control (Jul 08) - http://leelusoft.blogspot.com/
Shutdowner - http://www.eskiso.net/shutdowner.htm
Shutdown Guard (prevent shutdown) - http://code.google.com/p/shutdownguard/
Shutdown Monster - http://sourceforge.net/projects/shutdown/
Shutdown Programmer - http://www.vag-lab.com/blog/page/3/
Shutdown Scheduler (not Vista/W7) -
http://www.dnsoft.be/dn_software/dn_freeware/
Shutdown Suite - http://www.mystercrowley.com/software_system.php
Shutdown Timer - http://www.mcrenox.com.ar/downloads/
ShutdownUnless -
https://sites.google.com/a/obxcompguy.com/foolish-it/vb6-projects/shutdownunless-2
ShutDownWin - http://falcosoft.tk/softwares.html#desktopmovie
Shutdown XP faster -
http://www.softwaretipsandtricks.com/windowsxp/articles/243/1/
Shutdownz - http://conetek.com/
Shutter - http://www.den4b.com/
Simple Shutdown Timer - http://www.pcwintech.com/tools
Slawdog Smart Shutdown - http://www.slawdog.com/downloads/
Sleepy Timer - http://ziin.pl/en/sleepy_timer
Smart Close (all open apps) - http://bmproductions.fixnum.org/
SM Timer - http://www.smartturnoff.com/smlooka/
Sshutdown - http://eng.softq.org/sshutdown.htm
Stray (Shutdown/restart/switch user/log off/lock/sleep/hibernate) -
http://skwire.dcmembers.com/fp/?page=stray
SuperF4 (task) - http://code.google.com/p/superf4/
Super Fast Shutdown - http://www.xp-smoker.com/freeware.html
Suspend Tool - http://falcosoft.tk/softwares.html#desktopmovie
Switch Off - http://www.airytec.com/en/switch-off/

Task Force Quit - http://softorino.com/products/
Task Killer - http://www.rsdsoft.com/task_killer/index.php4
Timed Shutdown (schedule) - http://tinnes.org.uk/
Time To Go - http://timetogoappi.deviantart.com/
Toff - http://www.dennisbabkin.com/php/m_download.php
Turn Off Timer - http://www.utilitynerd.com/software/turnofftimer.html

Ultra Shutdown - http://www.sofonesia.com/
Unpowerit Now (turn Off/logOff/reboot/suspend/hibernate) -
http://www.dwebplace.com/tools.htm
User Profile Hive Cleanup tool
-
http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en

Win8Shutdown - http://www.tgmdev.be/win8shutdown.php
Windie - http://www.rovatronic.net/
Win Exit - http://www.hushpage.com/WinExit/winexit.html
Winmend Auto Shutdown - http://www.winmend.com/auto-shutdown/
WinOff - http://www.ampsoft.net/utilities/WinOFF.php
Wise Auto Shutdown - http://www.wisecleaner.com/wiseautoshutdownfree.html

XP Shutdown Event Tracker - http://support.microsoft.com/kb/293814

Zzz (schedule) - http://www.sumitbirla.com/software/

--
Regards
wasbit

VanguardLH

unread,
May 17, 2022, 11:35:01 AM5/17/22
to
Of the freeware you listed, do any of them do more than shutdown.exe
already included in Windows?

Use:

shutdown.exe

with:

/l = Logoff.
/s = Shutdown.
/r = Restart.
/h = Hibernate.
/hybrid = sleep w/hibernate as fallback.
/f = Force processes to exit (instead of waiting).

and lots more command-line args, like allowing a timeout during which
the user can abort. Run "shutdown /?" to see all options. To schedule
the operation, just use Task Scheduler. If you don't want to define a
scheduled event in Task Scheduler, but instead want to delay the
execution of shutdown.exe, use the timeout.exe program. You could
combine timeout and shutdown in a batch file, or use command chaining,
like:

timeout /t <numsecs> && shutdown <args>

This thread posted to and read in the Windows 10 newsgroup (and cross-
posted to the freeware newsgroup). I didn't bother to address
differences in the functions in and availablility of shutdown.exe on
older versions of Windows, and the same for the timeout.exe program.
Seems many, if not most, of the freeware 3rd party tools end up
duplicating what is already available in Windows.

Stan Brown

unread,
May 17, 2022, 11:44:13 AM5/17/22
to
On Tue, 17 May 2022 10:43:20 +0100, wasbit wrote:
>
[a long list of useless software, since Windows provides this, both
from the command line and in the GUI]



--
Stan Brown, Tehachapi, California, USA https://BrownMath.com/
Shikata ga nai...

JJ

unread,
May 17, 2022, 7:50:20 PM5/17/22
to
On Tue, 17 May 2022 10:43:20 +0100, wasbit wrote:
> Shutdown/Close/Hibernate/Suspend
>
> Use Scheduled Task in Windows
> Start / All Programs / Accessories / System Tools
> XP & Vista = Scheduled Tasks
> W7 = Task Scheduler
>
> List may be out of date.
[snip]

I'm still searching for a software which can provide a final confirmation
prompt whether the system is about to restart, shutdown, or when current
user is about to be logged off. Whether any of those operations were
initiated by a software, a service, a driver, or the system itself.

Bill

unread,
May 17, 2022, 10:25:41 PM5/17/22
to
On 5/17/2022 7:50 PM, JJ wrote:
> On Tue, 17 May 2022 10:43:20 +0100, wasbit wrote:
>> Shutdown/Close/Hibernate/Suspend
>>
>> Use Scheduled Task in Windows
>> Start / All Programs / Accessories / System Tools
>> XP & Vista = Scheduled Tasks
>> W7 = Task Scheduler
>>
>> List may be out of date.
> [snip]
>
> I'm still searching for a software which can provide a final confirmation
> prompt whether the system is about to restart, shutdown, or when current
> user is about to be logged off.


If you are sitting there to reply to a prompt, you don't need one.

Frank Slootweg

unread,
May 18, 2022, 10:18:37 AM5/18/22
to
VanguardLH <V...@nguard.lh> wrote:
> wasbit wrote:
>
> > Shutdown/Close/Hibernate/Suspend
> >
> > Use Scheduled Task in Windows
> > Start / All Programs / Accessories / System Tools
> > XP & Vista = Scheduled Tasks
> > W7 = Task Scheduler
> >
> > List may be out of date.

[...]

> Of the freeware you listed, do any of them do more than shutdown.exe
> already included in Windows?
>
> Use:
>
> shutdown.exe
>
> with:
>
> /l = Logoff.
> /s = Shutdown.
> /r = Restart.
> /h = Hibernate.
> /hybrid = sleep w/hibernate as fallback.
> /f = Force processes to exit (instead of waiting).
>
> and lots more command-line args, like allowing a timeout during which
> the user can abort. Run "shutdown /?" to see all options.

Well, while your '/hybrid' explanation implies a sleep, on Windows 8.1
the explanation is:

/hybrid Performs a shutdown of the computer and prepares it for fast
startup.
Must be used with /s option.

/s Shutdown the computer.

So at least on Windows 8.1, '/hybrid' is not a Sleep, but a Shutdown.

AKAIK, the Windows 'shutdown' command can not do a Sleep, therefor I
use Nirsoft's 'nircmd' with the 'standby' option ('nirmcmd /standby') to
initiate a Sleep.

As wasbit wrote

> > Shutdown/Close/Hibernate/Suspend

and I interpret his 'Suspend' as 'Sleep', I think the answer to your
question

> Of the freeware you listed, do any of them do more than shutdown.exe
> already included in Windows?

is 'Yes'! :-)

[...]

Stan Brown

unread,
May 18, 2022, 11:15:09 AM5/18/22
to
On 18 May 2022 14:18:32 GMT, Frank Slootweg wrote:
> Well, while your '/hybrid' explanation implies a sleep, on Windows 8.1
> the explanation is:
>
> /hybrid Performs a shutdown of the computer and prepares it for fast
> startup.
> Must be used with /s option.
> /s Shutdown the computer.
>
> So at least on Windows 8.1, '/hybrid' is not a Sleep, but a Shutdown.

That's just Microsoft, using the same word to mean two different
things as they do. The help text for the shutdown command in Windows
10 is similar.

> AKAIK, the Windows 'shutdown' command can not do a Sleep, therefor I
> use Nirsoft's 'nircmd' with the 'standby' option ('nirmcmd /standby') to
> initiate a Sleep.

You're correct, Windows 10's shutdown command doesn't include a
"sleep" option. However, under Additional power Options you can set
up Sleep as the result of actions such as pressing the power button
or closing the laptop's lid.

It does have a /i option. "shutdown /i" launches a GUI, so that you
don't have to remember the other options.

Bucky Breeder

unread,
May 18, 2022, 11:57:29 AM5/18/22
to
VanguardLH <V...@nguard.LH> posted this:

> Use:
>
> shutdown.exe


*YOU* use shutdown.exe, you feckless asshat.

Try some editing before you plagiarize another of your bloviated responses.


*NOTE: Now that leetle Ms. VanguardLH has obtained the title of "asshat",
they're trying for the 'Queen of Asshats' award by circumventing 'Bag of
Asshats' altogether.

"Whaaa whaaa, why you want freeware when Windows can already do it, whaaa
whaaa?"

Because who wants to use obsolete command line arguments when there's
FREEWARE with buttons and menus which can accomplish your objectives much
faster and better?

A: Old gender non-specific asshats with loaded geriatric diapers trying to
be relevant - since they're incapable of being superior.

Hope this helps.

--

I AM Bucky Breeder, (*(^;

And *NO*, that is *NOT* a Jedi Light Saber I have in my pocket!

But that doesn't necessarily mean I'm happy to see you either.

B. R. 'BeAr' Ederson

unread,
May 18, 2022, 12:53:15 PM5/18/22
to
On Wed, 18 May 2022 06:50:15 +0700, JJ wrote:

> I'm still searching for a software which can provide a final confirmation
> prompt whether the system is about to restart, shutdown, or when current
> user is about to be logged off. Whether any of those operations were
> initiated by a software, a service, a driver, or the system itself.

Have a look at this list:
https://www.raymond.cc/blog/prevent-cancel-and-abort-a-windows-system-shutdown-or-restart-when-application-is-running

BeAr
(F-Up set to acf.)
--
===========================================================================
= What do you mean with: "Perfection is always an illusion"? =
===============================================================--(Oops!)===

JJ

unread,
May 18, 2022, 10:29:36 PM5/18/22
to
On Tue, 17 May 2022 22:25:35 -0400, Bill wrote:

> On 5/17/2022 7:50 PM, JJ wrote:
>> On Tue, 17 May 2022 10:43:20 +0100, wasbit wrote:
>>> Shutdown/Close/Hibernate/Suspend
>>>
>>> Use Scheduled Task in Windows
>>> Start / All Programs / Accessories / System Tools
>>> XP & Vista = Scheduled Tasks
>>> W7 = Task Scheduler
>>>
>>> List may be out of date.
>> [snip]
>>
>> I'm still searching for a software which can provide a final confirmation
>> prompt whether the system is about to restart, shutdown, or when current
>> user is about to be logged off.
>
> If you are sitting there to reply to a prompt, you don't need one.

Unfortunately, that's not what I want.

JJ

unread,
May 18, 2022, 10:29:36 PM5/18/22
to
On Wed, 18 May 2022 18:53:10 +0200, B. R. 'BeAr' Ederson wrote:
>
> Have a look at this list:
> https://www.raymond.cc/blog/prevent-cancel-and-abort-a-windows-system-shutdown-or-restart-when-application-is-running
>
> BeAr
> (F-Up set to acf.)

Thank you for the suggestion.

OK. Of the 8 mentioned tools, none of them passes the test in a clean
Windows 7 x64 installation in VM, unfortunately. All applications were
specifically run as Administrator, to make sure that they have access to all
resources they might need. Main test is to use `shutdown.exe /r /t 5` and
see if the application can actually block the system restart operation.

The reports...

1. Shutdown Blocker succeeded on blocking the restart operation initiated by
`shutdown.exe /r /t 5`. However, if I copy `shutdown.exe` to e.g. `qwe.exe`
and run `qwe.exe /r /t5`, Shutdown Blocker can not block the system restart
operation. Meaning that's Shutdown Blocker can only block the operation
initiated specifically by `shutdown.exe`. IOTW, it can not block system
restart/shutdown operation initiated by other programs.

2. PreventTurnOff fails to block the restart operation initiated by
`shutdown.exe /r /t 5`.

3. Don't Sleep fails to block the restart operation initiated by
`shutdown.exe /r /t 5`.

4. Amphetamine fails to block the restart operation initiated by
`shutdown.exe /r /t 5`.

5. Shut It! is not applicable in the first place, because it requires user
to specify rules for which process name or application window title to
block. AND it does NOT support wildcard! So, in order to work on all
program, user will have to specify each and every possible process names and
application window titles that needs to be blocked - which is impossible.
While it may actually works, if it can not work universally, it does not
meet my requirement.

6. Free USB Guard fails to block the restart operation initiated by
`shutdown.exe /r /t 5`.

7. DShutdown fails to block the restart operation initiated by `shutdown.exe
/r /t 5`.

8. ShutdownGuard fails to block the restart operation initiated by
`shutdown.exe /r /t 5`.

So, my quest continues...

B. R. 'BeAr' Ederson

unread,
May 19, 2022, 12:40:09 AM5/19/22
to
On Thu, 19 May 2022 09:29:14 +0700, JJ wrote:

[Shutdown prevention freeware]
> Of the 8 mentioned tools, none of them passes the test

The author of Shutdown Blocker describes on the website (as well as in the
ReadMe.txt file accompanying the program) the hoops necessary to prevent
system shutdowns and some of the limitations encountered:

https://cresstone.com/apps/shutdownBlocker

> Shutdown Blocker succeeded on blocking the restart operation initiated by
> `shutdown.exe /r /t 5`. However, if I copy `shutdown.exe` to e.g. `qwe.exe`
> and run `qwe.exe /r /t5`, Shutdown Blocker can not block the system restart
> operation. Meaning that's Shutdown Blocker can only block the operation
> initiated specifically by `shutdown.exe`. IOTW, it can not block system
> restart/shutdown operation initiated by other programs.

As described in above mentioned text, shutdown.exe does /not/ use system
functions, that would be called by other (normal) programs to initiate a
shutdown/restart. Renaming shutdown.exe, which got a special handling by
Shutdown Blocker just because of its specificity, is more than "over the
top" wrt. the task you described.

Considering these extended requirements, you seem to want to prevent
shutdowns and restarts even on compromised systems (malware, malicious
users). On systems with such threads, Windows should be run in "Assigned
access mode" (aka "Kiosk mode") with only one or a selected few programs
enabled. (Kiosk mode has been available since WinXP, btw.)

https://docs.microsoft.com/en-us/windows/iot/iot-enterprise/kiosk-mode/kiosk-mode

BeAr

Sjouke Burry

unread,
May 19, 2022, 12:48:59 AM5/19/22
to
Used for years a shorcut with : C:\WINDOWS\system32\shutdown.exe -s
-f -t 04

Bill

unread,
May 19, 2022, 1:07:36 AM5/19/22
to
On 5/18/2022 10:29 PM, JJ wrote:
> On Tue, 17 May 2022 22:25:35 -0400, Bill wrote:
>
>> On 5/17/2022 7:50 PM, JJ wrote:
>>> On Tue, 17 May 2022 10:43:20 +0100, wasbit wrote:
>>>> Shutdown/Close/Hibernate/Suspend
>>>>
>>>> Use Scheduled Task in Windows
>>>> Start / All Programs / Accessories / System Tools
>>>> XP & Vista = Scheduled Tasks
>>>> W7 = Task Scheduler
>>>>
>>>> List may be out of date.
>>> [snip]
>>>
>>> I'm still searching for a software which can provide a final confirmation
>>> prompt whether the system is about to restart, shutdown, or when current
>>> user is about to be logged off.
>>
>> If you are sitting there ready to reply to a prompt, you don't need one.
>
> Unfortunately, that's not what I want.

That's why You should "design" what you want. I wrote and ran an
assembly program once which simply "threw an interrupt" just to see what
would happen. The whole system went black in an instant... You could say
it caused a shutdown.. ha! : ) I never did it a 2nd time. It helped
me appreciate that interrupts are what makes Windows what it is (i.e.,
asynchronous)...

Mr. Man-wai Chang

unread,
May 19, 2022, 11:27:00 AM5/19/22
to
On 17/5/2022 5:43 pm, wasbit wrote:
> Shutdown/Close/Hibernate/Suspend
>
> Use Scheduled Task in Windows
> Start / All Programs / Accessories / System Tools
> XP & Vista = Scheduled Tasks
> W7 = Task Scheduler
>
> List may be out of date.

Never needed one... interesting that there were so many entries.

JJ

unread,
May 20, 2022, 1:18:30 AM5/20/22
to
On Thu, 19 May 2022 06:40:03 +0200, B. R. 'BeAr' Ederson wrote:
>
> Considering these extended requirements, you seem to want to prevent
> shutdowns and restarts even on compromised systems (malware, malicious
> users). On systems with such threads, Windows should be run in "Assigned
> access mode" (aka "Kiosk mode") with only one or a selected few programs
> enabled. (Kiosk mode has been available since WinXP, btw.)
>
> https://docs.microsoft.com/en-us/windows/iot/iot-enterprise/kiosk-mode/kiosk-mode
>
> BeAr

Any software installer may initiate a system reboot, and their EXE file name
don't need to be `shutdown.exe`. It may even be the official `msiexec.exe`.
I don't think that scenario is related to compromised system or malware. The
idea is to prevent those which reboot the system without user consent. Some
software installers do that, even for some commercial software's installer.

JJ

unread,
May 20, 2022, 1:23:35 AM5/20/22
to
On Thu, 19 May 2022 06:48:52 +0200, Sjouke Burry wrote:
>>
> Used for years a shorcut with : C:\WINDOWS\system32\shutdown.exe -s
> -f -t 04

That's what I don't like. Other programs can initiate a forced system
restart/shutdown too. It'd be good if they provide a cancelable prompt. But
for those that don't, that's what I'm trying to prevent.

JJ

unread,
May 20, 2022, 1:34:08 AM5/20/22
to
On Thu, 19 May 2022 01:07:29 -0400, Bill wrote:
>
> That's why You should "design" what you want. I wrote and ran an
> assembly program once which simply "threw an interrupt" just to see what
> would happen. The whole system went black in an instant... You could say
> it caused a shutdown.. ha! : ) I never did it a 2nd time. It helped
> me appreciate that interrupts are what makes Windows what it is (i.e.,
> asynchronous)...

Because Windows API lack of a mechanism for user program to reliably reject
a system restart/shutdown request (WM_QUERYENDSESSION is useless, BTW), the
only way I could think of, is to use system wide API hook to intercept the
function that initiate the system restart/shutdown.

B. R. 'BeAr' Ederson

unread,
May 20, 2022, 11:22:29 AM5/20/22
to
On Fri, 20 May 2022 12:18:26 +0700, JJ wrote:

> Any software installer may initiate a system reboot, and their EXE file name
> don't need to be `shutdown.exe`.

What part of

| shutdown.exe does /not/ use system functions, that would be called by
| other (normal) programs to initiate a shutdown/restart

did you not understand??

Software installers usually initiate their reboot tasks by either method
1) or 3) of the explanations given alongside the Shutdown Blocker program.
Renaming the culprit (setup) program file will /not/ prevent shutdown or
restart blocking, as is the case when renaming Windows own shutdown.exe.

JJ

unread,
May 20, 2022, 10:33:06 PM5/20/22
to
On Fri, 20 May 2022 17:22:24 +0200, B. R. 'BeAr' Ederson wrote:
> Renaming the culprit (setup) program file will /not/ prevent shutdown or
> restart blocking, as is the case when renaming Windows own shutdown.exe.
>
> BeAr

That we can both agree.

B. R. 'BeAr' Ederson

unread,
May 21, 2022, 2:00:54 AM5/21/22
to
On Sat, 21 May 2022 09:33:01 +0700, JJ wrote:

> On Fri, 20 May 2022 17:22:24 +0200, B. R. 'BeAr' Ederson wrote:
>> Renaming the culprit (setup) program file will /not/ prevent shutdown or
>> restart blocking, as is the case when renaming Windows own shutdown.exe.
[...]
> That we can both agree.

Sounds as if you still see sth. to disagree. The only /real/ problem
you indicated until now was renaming shutdown.exe.

If this /active/ restart/shutdown circumvention path bothers you, then
Windows Kiosk mode (with white-listed applications and forbidden download
and installation of new programs) is the way to go.

And even then, a skilled malicious user may still be able to initiate a
system restart by just blue-screening a white-listed program...

Rule: Don't demand the *impossible* from simple freeware tools!

VanguardLH

unread,
May 21, 2022, 10:05:59 AM5/21/22
to
The hybrid description is inaccurate in the output of "shutdown /?". If
they got super detailed in the description, no one would read it.

I've never used Hybrid mode (aka Fast Startup), especially since it can
leave hardware in an unknown or unusable state. Reloading drivers in a
prior state without also re-initializing the hardware can render the
hardware unusable or flaky. Also, if there is a problem with your
Windows kernel session, it will still be there after a fast startup,
like getting stuck in a repeated restart of Windows.

In the past, I thought hybrid was a combo of hibernate and sleep. The
computer goes into sleep mode, but the hibernate state (hiberfil.sys
file) is first saved just in case the computer ends up getting powered
off. Sleep is a low power state, but that doesn't prevent the computer
from losing powering, like during a power outage. If the computer loses
power during sleep mode, it would have to do a full startup after power
is restored. Hibernate saves the state into a file, and powers off, but
hibernate saves both the kernel session and Windows user session.
Hybrid just saves the kernel session. Hybrid has the safety of a
partial hibernate should the computer lose power during sleep mode.

https://docs.microsoft.com/en-us/windows/win32/power/system-power-states

Hybrid sleep (S1-S3 + hibernation file)

Hybrid sleep is a special state that's a combination of the sleep and
hibernation states, it's when a system uses a hibernation file with
S1-S3. It's only available on some systems. When enabled, the system
writes a hibernation file but enters a higher-powered sleep state. If
power is lost while the system is sleeping, the system wakes from
hibernation, which takes longer but restores the user's system state.

S1 through S3 are sleep power states. Hybrid mode is a sleep mode:
logout the user session(s), save the kernel session to the hiberfil.sys
file (much smaller than saving kernel+user sessions), and the computer
goes into a "sleep" power state. Your computer goes into sleep, but
after first saving the kernel session as a backup should there be a
power outage.

https://www.windowscentral.com/how-disable-windows-10-fast-startup
"... hybrid sleep state where hibernation is used in tandem with a sleep
state."

Another confirming my supposition that hybrid mode involves a sleep
power state. A sleep mode is a power state, but not all power states
are sleep modes.

https://docs.microsoft.com/en-us/windows/win32/power/system-power-states
Even here hybrid mode is referenced as "hybrid sleep".

Hybrid aka Fast Startup mode has been reported numerous times by users
to cause nasty problems. I disabled it when I found out about it. When
I do a shutdown, I expect a startup to have the computer hardware get
initialized to a known state (a Reset signal is sent to hardware),
Windows loads afresh, and start a new Windows session after logging in.
I don't use hibernate mode, so there is also no advantage to hybrid
mode, to me, and hybrid mode causes problems (do an online search to
verify). Once I changed from an HDD (hard disk drive) aka spinner to a
SATA SSD, and then later changed to an NVMe m.2 SSD for the OS+app
partition, Windows startup was much faster, and I saw no need for
hibernate or hybrid power states. If you want to retain your current
Windows session, use a sleep power state, not something involving
shutdown.

https://petri.com/how-to-disable-windows-10-fast-startup-and-why-you-might-want-to/

The key thing to remember though is that in a traditional shutdown, we
close all of the user sessions, and in the kernel session we close
services and devices to prepare for a complete shutdown.

Now here’s the key difference for Windows 8: as in Windows 7, we close
the user sessions, but instead of closing the kernel session, we
hibernate it. Compared to a full hibernate, which includes a lot of
memory pages in use by apps, session 0 hibernation data is much
smaller, which takes substantially less time to write to disk.

Even if you use a slower SATA-attached SSD (versus faster NVMe SSD), the
point of using hybrid mode becomes mute. If you're using SATA-SSD or
NVMe-SSD, starting Windows is already a lot faster, especially since the
other hardware usually follows suit with improvements in speed. You're
not using a spinner anymore, so there's little need for hybrid mode.
Hibernate and hybrid were HDD-with-slow-CPU solutions. Considering the
problems that arise with hybrid mode, and with hibernate mode reloading
a Windows session that may have problems, and hybrid reloading a kernel
session that may not be fully initialized, especially regarding
hardware, a full start of Windows and session login is more than speedy
enough to warrant a full shutdown with no hibernate data. If you just
must have an immediate restore feature, use sleep instead of hibernate,
hybrid, or shutdown. However, hybrid would be a choice is you want the
safety of a hiberfil.sys backup of the kernel session should the
computer lose power during the sleep mode. From what I read, hybrid is
a preparatory hiberfil.sys save (of just the kernel session) in case of
power loss, but hybrid is a sleep mode (S1-S3 + hiberfil.sys write).

> AKAIK, the Windows 'shutdown' command can not do a Sleep, therefor I
> use Nirsoft's 'nircmd' with the 'standby' option ('nirmcmd /standby')
> to initiate a Sleep.

https://winaero.com/how-to-sleep-windows-10-from-the-command-line/

That mentions how to use the powercfg.exe program, but works only if
hibernation mode is disabled, or you use a batch script to disable
hibernation, run "rundll32.exe powrprof.dll,SetSuspendState 0,1,0", and
then reenable hibernate mode. As you noted, Nirsoft has a tool to go
into a sleep mode. Another is to use the SysInternals' (acquired by
Microsoft back in 2006) psshutdown.exe program. I've found Nirsoft to
have many useful tools, too, and have, for example, used nircmd to mute
and unmute the speakers in a batch script, or as a scheduled event in
Task Scheduler to silence my computer during my sleeping hours. If you
have the SysInternals tool suite, or just psshutdown, you don't need
NirCmd. If you have NirCmd, you don't need SysInternals.

I have both the suite of tools from SysInternals and Nirsoft. I didn't
think of using either since the shutdown.exe included in Windows will do
a hybrid "sleep". If I sleep my computer, it's because I'm away from
it. But if the computer loses power, like during a power outage, all
that time during sleep mode is wasted power (it's low-power, not
no-power) as the computer would have to do a fresh boot. With hybrid,
the computer goes into a sleep mode, but with hiberfil.sys as a safety
backup to more quickly get back up (well, up to loading Windows to the
point of where I'm prompted to login since the user session is not saved
to a file, just the kernel session).

VanguardLH

unread,
May 21, 2022, 10:28:56 AM5/21/22
to
JJ wrote:

> I'm still searching for a software which can provide a final
> confirmation prompt whether the system is about to restart, shutdown,
> or when current user is about to be logged off. Whether any of those
> operations were initiated by a software, a service, a driver, or the
> system itself.

The shutdown.exe tool included in Windows has the following argument:

/t xxx Set the time-out period before shutdown to xxx seconds. The
valid range is 0-315360000 (10 years), with a default of 30.

If you haven't returned to the computer in 10 years, you're dead or
still in prison, so it doesn't matter what the computer does. When you
use /t, the user gets notified of the pending shutdown/logoff.

To abort, maybe you could hit Ctrl+C; however, that would only work if
the shutdown.exe program pends its operation to let you hit Ctrl+C while
it was still running. Else, if shutdown.exe exits immediately (perhaps
because the action is scheduled instead of having the program itself do
the timeout), so Ctrl+C cannot be issued against the program, you have
the specified delay to use "shutdown /a".

/a Abort a system shutdown.
This can only be used during the time-out period.

Bucky Breeder

unread,
May 21, 2022, 10:34:19 AM5/21/22
to
VanguardLH <V...@nguard.LH> bloviated thusly
via news:g1jk3ytg6t5u$.dlg@v.nguard.lh:

> I've never used Hybrid mode (aka Fast Startup),

ZZZZZZZZZZZZZZZZZZZZZZZZZZZzzzzzzzzzzzzzzzzzzzzzz....


Must have slept through it.

Quick, somebody call h/is/er therapist.

<fingers-crossed>


Shortened Links Guaranteed Safe* by Author:

<https://tinyurl.com/y25an5fm>

<https://tinyurl.com/yckzeyhu>



*DISCLAIMER:

Exception in the case of feeble-brained snowflakes who may experience
idiopathic episodes of derangement, frothing, drooling, and/or ire.

Paul

unread,
May 21, 2022, 11:39:59 AM5/21/22
to
On 5/21/2022 10:05 AM, VanguardLH wrote:

> I've never used Hybrid mode (aka Fast Startup), especially since it can
> leave hardware in an unknown or unusable state. Reloading drivers in a
> prior state without also re-initializing the hardware can render the
> hardware unusable or flaky. Also, if there is a problem with your
> Windows kernel session, it will still be there after a fast startup,
> like getting stuck in a repeated restart of Windows.

But it does not do that.

If a kernel image is read out of the hiberfil.sys , the drivers
are each "warm started". That means the driver assumes
nothing, discovers hardware, puts things in a mode consistent
with that hardware, and so on. Much of the usual kinds of
work are done, when warming things up.

The whole purpose of hibernating just the kernel, is to avoid
the head movement of loading innumerable driver files. It's
just a chunk of memory image which is loaded. But then the
hardware drivers are "warm started", to sync them with the
hardware, so that the driver and the hardware are "reading
from the same script" and all is ready to go. That's how
the driver re-established the register fill, is by carrying
out the initialization sequence for that hardware.

While hibernated, the OS has to tolerate one of the
data drives being unplugged. The OS detects this, puts a
"toast" in the screen, telling the user how naughty they've
been, and... nothing crashes. If the driver just took off
on a series of assumptions, bad things would happen. But the
driver is not doing that. And much of the usual work of
detecting hardware and vetting it, is still being done.

Paul

Stan Brown

unread,
May 21, 2022, 12:25:43 PM5/21/22
to
On Sat, 21 May 2022 09:05:53 -0500, VanguardLH wrote:
> https://winaero.com/how-to-sleep-windows-10-from-the-command-line/
>
> That mentions how to use the powercfg.exe program, but works only if
> hibernation mode is disabled, or you use a batch script to disable
> hibernation, run "rundll32.exe powrprof.dll,SetSuspendState 0,1,0", and
> then reenable hibernate mode.

And for an additional inconvenience, the commands must be run in an
elevated command prompt. (That's according to the article you cited;
I didn't verify.)

> As you noted, Nirsoft has a tool to go
> into a sleep mode. Another is to use the SysInternals' (acquired by
> Microsoft back in 2006) psshutdown.exe program. I've found Nirsoft to
> have many useful tools, too, and have, for example, used nircmd to mute
> and unmute the speakers in a batch script, or as a scheduled event in
> Task Scheduler to silence my computer during my sleeping hours. If you
> have the SysInternals tool suite, or just psshutdown, you don't need
> NirCmd. If you have NirCmd, you don't need SysInternals.

I tried running "psshutdown -d" but got the error message

Couldn't install PsShutdown service:
Access is denied.

It did run okay in an command prompt, but then when I tried again in
a regular command prompt I got the same message. Am I missing
something here?

Gronk

unread,
May 22, 2022, 4:54:42 AM5/22/22
to
Paul wrote:

> While hibernated, the OS has to tolerate one of the
> data drives being unplugged. The OS detects this, puts a
> "toast" in the screen, telling the user how naughty they've
> been, and... nothing crashes.

That toast makes the most sense for my needs.
[1] Inactivity eventually initiates a shutdown
[2] A toast comes up (or not) if a program will lose data
[3] User can come back later to see what he'd do about it

If there isn't a toast, it shuts down after inactivity.
If there is a toast, the machine waits for user input.

That would be perfect to me.
Does that exist?

VanguardLH

unread,
May 23, 2022, 12:25:16 PM5/23/22
to
Paul wrote:

> If a kernel image is read out of the hiberfil.sys , the drivers
> are each "warm started". That means the driver assumes
> nothing, discovers hardware, puts things in a mode consistent
> with that hardware, and so on. Much of the usual kinds of
> work are done, when warming things up.

Assuming the hardware does not require a Reset to get it into a known
state. I've seen where drivers can no longer interface with the
hardware because the hardware isn't in a state known to the driver code.
The only way to get the hardware working again is with a cold boot which
has the CPU issue a Reset to all hardware. That's why, for example,
during a cold boot you will see the LEDs flash on the keyboard.

If the kernel image is saved, but there is an issue with the hardware,
that issue will still be there when the kernel image is restored,
because the hardware is still in an unknown state.

It's been a long time since I ran into hardware that got into an unknown
state that the driver didn't understand or could figure out to fix. The
last time I remember was with a Winmodem. It got into a state the
driver couldn't address, and a cold boot was needed to get a Reset
signal to the Winmodem.

> The whole purpose of hibernating just the kernel, is to avoid
> the head movement of loading innumerable driver files.

*IF* that works okay. Probably does in most scenarios, but reinstating
a driver in a state for which the hardware isn't initialized or for
hardware in an unknown state to the driver means the warm-loaded driver
is still out of alignment with the state of the hardware. Driver code
isn't perfect, either, and its developers may not take into account when
the hardware is in a state that the code cannot handle.

> That's how
> the driver re-established the register fill, is by carrying
> out the initialization sequence for that hardware.

When resuming from a sleep power state, no Reset is sent to the
hardware. A warm boot won't issue a Reset. A cold boot is needed.

VanguardLH

unread,
May 23, 2022, 12:51:30 PM5/23/22
to
Stan Brown wrote:

> I tried running "psshutdown -d" but got the error message
>
> Couldn't install PsShutdown service:
> Access is denied.
>
> It did run okay in an command prompt, but then when I tried again in
> a regular command prompt I got the same message. Am I missing
> something here?

"psshutdown -d" ran for me (Windows 10 Home x64 21H2). I didn't specify
a timeout, so the default of 20 seconds got used. My computer shutdown
okay, and without the error prompt you mention. I ran the tool inside
an elevated command shell ("run as administrator" option in shortcut
definition). The shortcut I use to cmd.exe runs it elevated since there
are way too many console-mode programs that I run that need admin privs.
I get the UAC prompt when I use the shortcut, but I'd rather keep UAC
enabled and get nuisanced with the UAC prompt. Win+R hotkey is a
non-elevated command shell.

While lots of users disable UAC, I've found it automatically handles
some permissions that are needed for elevated processes. Without UAC
handling that (when I okay the execute), I've run into permission
problems (that I'd rather not bother handling in changing access
permissions on whatever executables are involved).

I've also read that you must run psshutdown under a Windows account that
is included in the Administrators security group; i.e., you need to run
it when logged in under an admin-level account. That's probably because
the psshutdown.exe program tries to install the psshutdown service. If
it runs successfully, you'll find a new service called "PsShutdown" when
you use services.msc to look at the services. The service
(C:\Windows\pssdnsvc.exe) is set to Manual startup mode, because a
caller process triggers the service. You should see the pssdnsve.exe
file under C:\Windows (which is what the service is configured to use).

That you get the error on the PsShutdown Service means there is a
problem with your Windows setup in not allowing programmatic service
definition, like some protection is blocking you from defining a
service. Again, make sure you run the program while logged in under a
Windows account included in the Administrators security group, so you
have permission to install services. I haven't investigated if running
the tool inside an elevated command shell also grants you permission to
install services.

I suspect a service is required to allow functionality after logoff.
Services run whether you've logged into a Windows account, or not.

Gronk

unread,
May 23, 2022, 1:43:30 PM5/23/22
to
wasbit wrote:

> Shutdown/Close/Hibernate/Suspend
>
> Use Scheduled Task in Windows

If there isn't a toast, it shuts down after inactivity.
If there is a toast, the machine waits for user input.

That would be perfect to me.
Does that exist in that long list?

Stan Brown

unread,
May 23, 2022, 6:30:48 PM5/23/22
to
On Mon, 23 May 2022 11:51:25 -0500, VanguardLH wrote:
>
> Stan Brown wrote:
>
> > I tried running "psshutdown -d" but got the error message
> >
> > Couldn't install PsShutdown service:
> > Access is denied.
> >
> > It did run okay in an command prompt, but then when I tried again in
......OOPS!..........^.ELEVATED
> > a regular command prompt I got the same message. Am I missing
> > something here?
>
> "psshutdown -d" ran for me (Windows 10 Home x64 21H2). ... inside
> an elevated command shell ("run as administrator" option in shortcut
> definition).

Yes, for me too (though I have Pro 21H1). I did a terrible job of
proofreading my original article, omitting the word "elevated".

> I've also read that you must run psshutdown under a Windows account that
> is included in the Administrators security group; i.e., you need to run
> it when logged in under an admin-level account. That's probably because
> the psshutdown.exe program tries to install the psshutdown service. If
> it runs successfully, you'll find a new service called "PsShutdown" when
> you use services.msc to look at the services.

My user name is marked as "Local Account" and "Administrator" in
Settings » Your Info. But having an admin-level _account_ is not the
same as opening an administrative _command_prompt_, as you know. So
maybe your source omitted to mention that that's a requirement too?

> The service
> (C:\Windows\pssdnsvc.exe) is set to Manual startup mode, because a
> caller process triggers the service. You should see the pssdnsve.exe
> file under C:\Windows (which is what the service is configured to use).

Running PsShutdown in an elevated command prompt did create the
service, set to manual. It was not running after I woke up the
computer again, but both the service and the executable were present.

When I again tried to run PsShutdown in a non-elevated account, I got
the error message
Couldn't install PsShutdown service:
Access is denied.
So I think either PsShutdown checks and won't run if it's not
elevated, or starting a service, even one that's already installed,
requires an elevated command prompt.

> That you get the error on the PsShutdown Service means there is a
> problem with your Windows setup in not allowing programmatic service
> definition, like some protection is blocking you from defining a
> service.

I checked in the Malwarebytes log, and there was nothing there. But
EventVwr shows an error event, with the explanatory text "The
PsShutdown service is marked as an interactive service. However, the
system is configured to not allow interactive services."

Googling that message, I found
> https://documentation.n-able.com/N-
central/troubleshooting/Content/kb/Take-Control-N-able-N-central-
Error-The-system-is-configured-to-not-allow-interactive-services-
This-service-may-not-function-properly.htm
(Sorry: Gravity breaks on a hyphen. I don't know if that's a soft
break or hard break.)
It said interactive services have been disallowed since 2019 or 2020.
It did give a registry hack: change
hklm\system\currentcontrolset\control\windows!NoInteractiveServices
from 1 to 0. (I guess that elevated programs aren't affected by that
Registry value, since PsShutdown succeeds in an elevated prompt.)

I chose not to try that. I only started down this rabbit hole out of
curiosity, and I don't want to spend more time on it. Though I'm a
comamnd-line guy, on the rare occasions when I want the PC to sleep
instead of hibernate I don't find it too onerous to click the Start
icon, then Power, then Sleep. I've removed the service (SC delete
psshutdownsvc, then delete C:\Windows\pssdnsvc.exe) and deleted
PsShutdown.exe.

VanguardLH

unread,
May 29, 2022, 11:31:10 PM5/29/22
to
Stan Brown wrote:

> My user name is marked as "Local Account" and "Administrator" in
> Settings » Your Info. But having an admin-level _account_ is not the
> same as opening an administrative _command_prompt_, as you know. So
> maybe your source omitted to mention that that's a requirement too?

You're logging in and using the Adminstrator account? That should never
get touched except for emergency/recovery use. In fact, I define
another account, BkupAdmin, which is included in the Administrators
security group.

If you are using some account other than Administrator, make sure it is
listed in the Administrators (plural) security group. To find out to
which security group(s) your Windows account belongs, run:

net user <youraccount>

Check "Local Group Memberships" lists Administrators.

> When I again tried to run PsShutdown in a non-elevated account, I got
> the error message
> Couldn't install PsShutdown service:
> Access is denied.
> So I think either PsShutdown checks and won't run if it's not
> elevated, or starting a service, even one that's already installed,
> requires an elevated command prompt.

I looked at the ACLs on the PSSDNSVC.exe file, and the USERS security
group have read & execute privileges, and the Adminstrators security
group has all privs.

You must have UAC disabled to not get that prompt before seeing the
error messages you mention. I know a lot of users that get pissed at
having to okay the UAC prompt, so they disable UAC. However, as
mentioned, I found that UAC can override some permissions when you okay
the program to run. Not sure why MS would do it that way. With UAC
enabled, a program would run elevated. When UAC disabled, I had to go
into file permissions to get it to run okay.

Could be, as you surmised, the PS service won't run when a caller
doesn't itself have elevated permissions.

When I ran "sc query", the psshutdownsvc service wasn't listed. Then I
noticed the output was only for services in the Running state. The
default of "sc query" is with "state= active". So I changed it to run
"sc query state= all" which then included the PsShutdownSvc. That still
didn't tell me what privs are needed to start the service, but does
mention "(interactive)" which is somewhat described at:

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-config

that mentions:

"Interactive services must be run under the LocalSystem account."

When I look at the permissions on PSSDNSVC.exe, the SYSTEM account is
listed. When looking at other executables, like notepad.exe, the SYSTEM
account is also listed, but with limited privileges (read & execute).
However, the PSSDNSVC.exe file has the SYSTEM account will full privs
which includes Write permission that is missing from other executables
with SYSTEM having just read & execute. Not even the sc.exe (service
control) program has SYSTEM with Write privilege.

Most services are designed to NOT interface with the user. That is,
they have no GUI or console input or output, so no interaction with the
user. The PsShutdownSvc is interactive which might explain why it must
be called by a caller with admin privs, so the service as a child
process also has admin privs to call the shutdown API.

https://docs.microsoft.com/en-us/windows/win32/services/interactive-services

As you suggest, maybe the caller (psshutdown.exe) refuses to call the
PsShutdownSvc if the caller doesn't have admin privs since that would be
the child process (service) wouldn't have the required privs, either.

I've not delved this far into services, especially interactive ones (I
thought they were all non-interactive, so I learned something new).

> https://documentation.n-able.com/N-central/troubleshooting/Content/kb/Take-Control-N-able-N-central-Error-The-system-is-configured-to-not-allow-interactive-services-This-service-may-not-function-properly.htm

shortURL: https://tinyurl.com/bdf3344d

> It said interactive services have been disallowed since 2019 or 2020.

Yet the MS article I found on interactive services is dated Jan 7, 2021.
I'm running Windows 10 Home x64 21H2 which is much later than the 1803
build, and psshutdown.exe works for me when run with elevated
privileges, and when ran under a Windows account in the Administrators
security group.

"Interactive Service Detection"

That does not look like defining a service that is interactive, only in
detecting which ones are, and perhaps to prevent malware from
interferring with interactive services.

https://www.file.net/process/ui0detect.exe.html
""UI0Detect.exe" is a Microsoft core system file in
"C:\Windows\System32" called a "mitigation." Running as a service in
Session 0, it detects if another service in Session 0 tries to show a
User Interface (UI)."

Is allowing one service to snoop on another to find those that are
interactive a good thing? UI0Detect was to allow mitigation, like a
service crashed, but maybe it was getting abused. UI0Detect.exe is not
present on my current setup. From some perusal, seems UI0Detect caused
more problems than it cured.

https://answers.microsoft.com/en-us/windows/forum/all/we-noticed-that-the-interactive-services-detection/fad0c42f-9d12-4cf6-a54a-2f9cf8731e4f

"We use the service Interactive Services Detection to register a
licensing service for our software."

Didn't realize UI0Detect was for that purpose. Seems a workaround to
the normal process to install and define a service, and to provide
excessive privs to the UI for an interactive service.

When you update to or install Windows 10 Version 1803 or later or
Server 2019, the Interactive Services Detection Service (UI0Detect)
will no longer be present.


This means you can no longer switch desktop to Session 0.
Additionally, native Windows services marked as "Allow service to
interact with the desktop" via the Services applet (i.e. services.msc)
are no longer granted interactive with desktop rights by the Windows
Service Control Manager (SCM). Hence, even when you switch desktop to
Session 0, those native interactive services will no longer be
visible.

Doesn't seem a user interface (GUI or console) should really be running
in session 0. That's for the OS, services and drivers. I don't see
interactive services should be running in session 0, either.

https://www.coretechnologies.com/blog/windows-services/interactive-services-removed-windows-10/

Since I'm on Windows 10 Home x64 21H2, I think UI0Detect.exe is
unrelated to why psshutdown.exe needs to have admin privs to call a
service, or the service, as a child process, must have admin privs to
issue shutdown API calls.

https://docs.microsoft.com/en-us/sysinternals/downloads/psshutdown

That's the MS web page describing psshutdown.exe, and is dated Oct 12,
2021, long after the 1803 build got released (Apr 30, 2018).

psshutdown.exe and its interactive PsShutdownSvc shouldn't be trying to
open a user interface that is running in session 0. They should be
calling the shutdown API as any programmatic tools should use.

https://docs.microsoft.com/en-us/windows/win32/shutdown/system-shutdown-functions

> It did give a registry hack: change
> hklm\system\currentcontrolset\control\windows!NoInteractiveServices
> from 1 to 0. (I guess that elevated programs aren't affected by that
> Registry value, since PsShutdown succeeds in an elevated prompt.)

It's set to 1, for me.

Stan Brown

unread,
May 30, 2022, 2:16:05 PM5/30/22
to
On Sun, 29 May 2022 22:31:03 -0500, VanguardLH wrote:
>
> Stan Brown wrote:
>
> > My user name is marked as "Local Account" and "Administrator" in
> > Settings » Your Info. But having an admin-level _account_ is not the
> > same as opening an administrative _command_prompt_, as you know. So
> > maybe your source omitted to mention that that's a requirement too?
>
> You're logging in and using the Adminstrator account?

No. My user name is Stan, and the account was created when I
installed Windows 10.

> That should never
> get touched except for emergency/recovery use.

I agree.

> If you are using some account other than Administrator, make sure it
> is listed in the Administrators (plural) security group. To find out to
> which security group(s) your Windows account belongs, run:
>
> net user <youraccount>

This gives more detailed information than Settings » Your Info, but
where they overlap they are consistent. My account is a member of the
local group "Administrators." I have not messed with Win 10 Pro's UAC
in any way.
0 new messages