() () does Windows close machine executive which order be? In which is method analysed?

() () does Windows close machine executive which order be? In which is method analysed? I close machine it is to carry out really, "Begin " -- close machine " he is executive which order lets a system stop to move, method is being put in which, if be correct, add 20 minutes again Windows closes machine measure to involve Windows many component and many processes, say simply, of Windows passing machine measure is not most person those who think is so simple. Basic course is such: 1. The user is initiated after involving machine statement, initiate the program that involves machine statement to be able to inform Windows subsystem of CSRSS.EXE, after CSRSS.EXE receives an announcement, meeting and Winlogon.EXE make trade of a data, inform by Winlogon.EXE CSRSS.EXE begins to shut systematic circuit then. 2. After CSRSS.EXE receives the announcement of Winlogon.EXE, can ordinal inquiry has the user process of window carrying a layer on the head, let these user processes exit. The overtime time that if certain user process is in,acquiesces 5000 millisecond (can register set of HKEY_CURRENT_USER\Cont Rol Panel\Desktop\ HungAppTimeout of the value that express key through revising overtime time) inside if was not being exited, windows can show dialog box of an end task is used at enquiring whether the user ends this mission. This dialog box will show below acquiescent circumstance and maintain all the time and won't shut automatically. To console program, basic case is similar, just value of Windows use HK EY_CURRENT_USER\Control Panel\Desktop\ WaitToKillAppTimeout will set overtime time. 3. It is to be turn for then end systematic process. Systematic process includes SMSS.EXE, Winlogon.EXE, Lsass.EXE to wait. Windows does not resemble stopping user process to if cannot be inside formulary time,stop a clew user in that way when ending systematic process, skip this process however, go to those who carry out next system process ending an operation. Use overtime time and the time that the 2nd pace uses are same. 3 afore-mentioned measure are whole Windows in involving machine process most a paragraph when expend time, because these 3 measure are caused,great majority involves the account with slow machine is. After before finishing 3 measure, entered the 4th phase that closes machine operation, also be the last phase. 4. Winlogon.EXE calls NtShutdownSystem() of function of a former unripe API to command the system carries out the round off job from the back. Inside this phase, executive subsystem can finish Windows to close machine operation finally, for example: Awl of soft-shelled turtle of Sun of Su of  of  of uncut jade lid defends Juan Qiang to vase ǖ of Zan of  of  of tip suddenly ┣ suckles? of faint Liao Zhuang also is in this phase, the enrollment that configuration management system will been revised expresses data to be able to write disk inside. Wait to manage the following all subsystem to finish besides power source after exiting, power source management completes last operation: After  of Tao of ⒐ of reins narrow Dian takes what? understood Windows to involve machine technological process, analyse below in front those who say is fast how is closing machine operation finished. Analyse the principle of SuperFast Shutdown first, use Visual Basic writes SuperFast Shutdown, volume is very minor, with respect to 15KB, after the course is analysed, reach a surprising conclusion: SUperFast Shutdown uses RtlAdjustPrivilege() to promote his attributive above all, call NtShutdownSystem() function to finish directly next involve machine process. Direct as a result of before 3 measure that had jumped to expend time most enter the 4th measure, caused so can close the false appearance of machine very quickly. View task government again implement close quickly machine how to come true: Colour of  of the Mao that treat soft-shelled turtle is grabbed hey the principle of plain 赟 UperFast Shutdown, also be involve the rate of machine through omiting a few move will accelerate. So, why closing the case that can the setting appear to lose after machine quickly? What there is to make a process normal exit inside before the reason depends on 3 measure is likely. Most software can save a few settings inside space of memory of him illicit some when write, just answer these settings when software is shut write specific place, if register watch or document of a certain configuration inside. And the 4th pace that closes machine operation did not offer a kind of way to be able to let these install a record to come down, because this phase Windows has thought in front all flow that must pass had been finished, those who remain is the exit problem of Windows core component. Below this kind of circumstance, use close quickly machine bring about a setting to lose insufficient also to was blamed. Accordingly, for the health of your system, close machine or come according to normal order, the security of data often compares a few economic seconds that many important.