Windows Shutdown Messages

Question

I wanted to correctly manage the shutdown of Windows in my application with data to save. However, the officiel documentation updated in July 2021 does not match what I noticed and refers to changes between Windows XP and Vista. After many tests, it appears that things are different since Windows 10 at least (Tests on 10 and 11 but not on 8 or 8.1).

Here is some officials links that are at least OUTDATED:

• https://learn.microsoft.com/en-us/windows/win32/shutdown/system-shutdown
• https://devblogs.microsoft.com/oldnewthing/20200414-00/?p=103671

I haven't found any other updated documentation that reflects what I found, so I'll present it here.

Answer 1

Here are my conclusions based on many tests on Windows 11 (23H2) and few confirmations tests on Windows 10. This is not applicable to Windows 7 and earlier versions (see official documentation for those).

When you want to shut down Windows, all apps receive WM_QUERYENDSESSION message at the same time without queuing. They have 5 seconds to respond (but the sooner the better) whether or not they agree to close by filling the result message 1 or 0.

• If it agrees, it immediately receives WM_ENDSESSION message.
• If it disagree, it doesn't get anything else at this time.

If at least one of the following points is met:

• At least one app responded that it disagreed.
• At least one app did not respond within 5 seconds to WM_QUERYENDSESSION.
• At least one app that responded that it could close took more than 5 seconds to respond to subsequent WM_ENDSESSION.

Then Windows displays to the user a full screen presenting the list of apps that have not closed, and offers to force extinction anyway.

If the user cancels, nothing special happens, but if he forces the extinction:

• Apps that refused to close receive WM_ENDSESSION with the CRITICAL flag then are killed quickly without a predefined delay.
• Apps which had accepted to close but are still processing their WM_ENDSESSION are killed without another message to warn them.

In conclusion, the fact that you should response in less than 5 seconds each to WM_QUERYENDSESSION and WM_ENDSESSION is true, but the fact that apps are not anymore called one by one is a real changer about the global behaviour.