7 ms·

Windows' Undocumented “Emergency Restart”

138 points by jonathantf2 4y ago

mrtesthah 4y ago
Sounds like the Windows equivalent of shutdown -r now
- gruez 4y ago
  No, not really, from the OP >After a bit of testing with Restart-Computer and shutdown /r /f, I've found that no officially-documented shutdown command or function comes close in speed -- they both take a fair bit of time to work, and importantly, they both register in the Event Log as a clean shutdown. So what's going on here? IME shutdown -r now definitely takes it sweet time (ie. getting stuck on "A stop job is running ..."
  - mrtesthah 4y ago
    It's pretty quick on macOS.
  - memcg 4y ago
    Sysinternal's "pskill csrss" used to be my last resort to reboot remote or local desktops and VMs. Saved my ass many times.
  - robonerd 4y ago
    > (ie. getting stuck on "A stop job is running ..." Trying to unmount a manually mounted network drive after already taking down the network... very frustrating. Seeing the time remaining counter jump from 30 seconds to 2+ minutes after the first 30 seconds passes is rage inducing. Do I really need to read the jargon dense documentation for a damn init system to get my computer to behave in a sensible way? Thanks Lennart.
- kevinoid 4y ago
  Perhaps a closer analog would be halt(8) with the -q (BSD) or -f (Linux) option to avoid calling init(8): https://man.openbsd.org/halt https://man.openbsd.org/halt https://manpages.debian.org/halt https://manpages.debian.org/halt
  - mrtesthah 4y ago
    Yes, that's what I was thinking of.
  - chasil 4y ago
    On my RHEL systems: -f / --force : "Force immediate halt, power-off, or reboot. When specified once, this results in an immediate but clean shutdown by the system manager. When specified twice, this results in an immediate shutdown without contacting the system manager." "...all processes will be killed forcibly and all file systems are unmounted or remounted read-only. This is hence a drastic but relatively safe option to request an immediate reboot. If --force is specified twice for these operations, they will be executed immediately without terminating any processes or unmounting any file systems. Warning: specifying --force twice with any of these operations might result in data loss."
- forgotpwd16 4y ago
  This is a normal reboot. If anything seems more like a reboot issued via magic system request.
  - dinom 4y ago
    Agreed, seems to be exactly this. https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html https://www.kernel.org/doc/html/latest/admin-guide/sysrq.htm... echo 1 > /proc/sys/kernel/sysrq # enable sysrq echo o > /proc/sysrq-trigger # immediately power off
krylon 4y ago
Do I understand this correctly as being the software equivalent of pushing the reset button? Or am I missing something? I wonder what the history behind this feature is.
- omoikane 4y ago
  Top comment has a link to more details. Apparently it's NtSetSystemPowerState from ntdll. https://www.codeproject.com/Articles/34194/Performing-emergency-shutdowns https://www.codeproject.com/Articles/34194/Performing-emerge...
dend 4y ago
Indeed the feature is undocumented, but it's been known for some time - its goal is to mimic as much as possible the reset button, for those situations when your computer freezes up to a point where Ctrl+Alt+Del works, but literally no other process responds. Think "Background process locked up my OS, and I can't do anything short of unplugging the computer." Especially helpful on a laptop where the physical reset button is not available.
- forgotpwd16 4y ago
  What always found impressive on Windows is C-A-Del will always work.
  - hammyhavoc 4y ago
    I can name hundreds of occasions from first-hand experience where it hasn't worked in the past 26 years for me on a variety of machines in various environments.
    - memcg 4y ago
      Me too.
    - beebmam 4y ago
      Blue screen of death, for example.
    - nyanpasu64 4y ago
      One prominent example I've seen multiple times, is hanging in the shutdown screen where no text appears under the spinning dots, and Ctrl-Alt-Del does nothing.
  - jkingsman 4y ago
    Ctrl+Alt+Del invokes WinLogon, the highest priority process, that then delivers the task manager. I believe this is a kernel invocation, so regardless of user land dysfunction, it will always work. Tthis is possibly attributable as much to convenience as it is to security -- the Secure Attention Sequence[1] is intended as a login-spoofind protection which will suspend other tasks (like a spoofed login screen) before continuing forward with user auth. [1]: https://en.wikipedia.org/wiki/Secure_attention_key https://en.wikipedia.org/wiki/Secure_attention_key
kozak 4y ago
Equivalent of the old good double-press of Ctrl-Alt-Del that we used to have in Windows 9x?
- UI_at_80x24 4y ago
  Ctl+Alt+Del has been a BIOS designated interrupt for REBOOT since the DOS 3 (or even before, but that's the edge of my memory) days. Win9x "tried" to intercept it; but was never 100% successful.
schroeding 4y ago
Besides the mentioned NtSetSystemPowerState function, which this feature calls, there are also other undocumented API functions that allow to shutdown / restart the sytem immediately, like NtRaiseHardError (which allows to cause a bluescreen-like unclean shutdown with normal user permissions as a fun side-effect).
psyclobe 4y ago
I _always_ reboot with 'shutdown /f /r /t 0', the interactive shutdown/reboot stuff is worthless

138 points by jonathantf2 4y ago

mrtesthah 4y ago

Sounds like the Windows equivalent of shutdown -r now

gruez 4y ago
No, not really, from the OP >After a bit of testing with Restart-Computer and shutdown /r /f, I've found that no officially-documented shutdown command or function comes close in speed -- they both take a fair bit of time to work, and importantly, they both register in the Event Log as a clean shutdown. So what's going on here? IME shutdown -r now definitely takes it sweet time (ie. getting stuck on "A stop job is running ..."
- mrtesthah 4y ago
  It's pretty quick on macOS.
- memcg 4y ago
  Sysinternal's "pskill csrss" used to be my last resort to reboot remote or local desktops and VMs. Saved my ass many times.
- robonerd 4y ago
  > (ie. getting stuck on "A stop job is running ..." Trying to unmount a manually mounted network drive after already taking down the network... very frustrating. Seeing the time remaining counter jump from 30 seconds to 2+ minutes after the first 30 seconds passes is rage inducing. Do I really need to read the jargon dense documentation for a damn init system to get my computer to behave in a sensible way? Thanks Lennart.
kevinoid 4y ago
Perhaps a closer analog would be halt(8) with the -q (BSD) or -f (Linux) option to avoid calling init(8): https://man.openbsd.org/halt https://man.openbsd.org/halt https://manpages.debian.org/halt https://manpages.debian.org/halt
- mrtesthah 4y ago
  Yes, that's what I was thinking of.
- chasil 4y ago
  On my RHEL systems: -f / --force : "Force immediate halt, power-off, or reboot. When specified once, this results in an immediate but clean shutdown by the system manager. When specified twice, this results in an immediate shutdown without contacting the system manager." "...all processes will be killed forcibly and all file systems are unmounted or remounted read-only. This is hence a drastic but relatively safe option to request an immediate reboot. If --force is specified twice for these operations, they will be executed immediately without terminating any processes or unmounting any file systems. Warning: specifying --force twice with any of these operations might result in data loss."
forgotpwd16 4y ago
This is a normal reboot. If anything seems more like a reboot issued via magic system request.
- dinom 4y ago
  Agreed, seems to be exactly this. https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html https://www.kernel.org/doc/html/latest/admin-guide/sysrq.htm... echo 1 > /proc/sys/kernel/sysrq # enable sysrq echo o > /proc/sysrq-trigger # immediately power off

krylon 4y ago

Do I understand this correctly as being the software equivalent of pushing the reset button? Or am I missing something? I wonder what the history behind this feature is.

omoikane 4y ago
Top comment has a link to more details. Apparently it's NtSetSystemPowerState from ntdll. https://www.codeproject.com/Articles/34194/Performing-emergency-shutdowns https://www.codeproject.com/Articles/34194/Performing-emerge...

dend 4y ago

Indeed the feature is undocumented, but it's been known for some time - its goal is to mimic as much as possible the reset button, for those situations when your computer freezes up to a point where Ctrl+Alt+Del works, but literally no other process responds. Think "Background process locked up my OS, and I can't do anything short of unplugging the computer." Especially helpful on a laptop where the physical reset button is not available.

forgotpwd16 4y ago
What always found impressive on Windows is C-A-Del will always work.
- hammyhavoc 4y ago
  I can name hundreds of occasions from first-hand experience where it hasn't worked in the past 26 years for me on a variety of machines in various environments.
  - memcg 4y ago
    Me too.
  - beebmam 4y ago
    Blue screen of death, for example.
  - nyanpasu64 4y ago
    One prominent example I've seen multiple times, is hanging in the shutdown screen where no text appears under the spinning dots, and Ctrl-Alt-Del does nothing.
- jkingsman 4y ago
  Ctrl+Alt+Del invokes WinLogon, the highest priority process, that then delivers the task manager. I believe this is a kernel invocation, so regardless of user land dysfunction, it will always work. Tthis is possibly attributable as much to convenience as it is to security -- the Secure Attention Sequence[1] is intended as a login-spoofind protection which will suspend other tasks (like a spoofed login screen) before continuing forward with user auth. [1]: https://en.wikipedia.org/wiki/Secure_attention_key https://en.wikipedia.org/wiki/Secure_attention_key

kozak 4y ago

Equivalent of the old good double-press of Ctrl-Alt-Del that we used to have in Windows 9x?

UI_at_80x24 4y ago
Ctl+Alt+Del has been a BIOS designated interrupt for REBOOT since the DOS 3 (or even before, but that's the edge of my memory) days. Win9x "tried" to intercept it; but was never 100% successful.

schroeding 4y ago

Besides the mentioned NtSetSystemPowerState function, which this feature calls, there are also other undocumented API functions that allow to shutdown / restart the sytem immediately, like NtRaiseHardError (which allows to cause a bluescreen-like unclean shutdown with normal user permissions as a fun side-effect).

psyclobe 4y ago

I _always_ reboot with 'shutdown /f /r /t 0', the interactive shutdown/reboot stuff is worthless