How to trace what prevented Windows from shutting down at all?

tfwul · 14 Aug 2016

Windows 10 10586.545

After closing all applications the way it should (File->Exit) it happens that Windows does not shut down at all.
It does not go any further that this 'Shutting down" screen.
Nothing is happening, not after 1 hour, 2 hours.
Usually I shut down and walk away. It happened I returned after a couple of 4-5 hours (or even the next day...)
and this screen is still there.

This is happening occasionally only. It is impossible to reproduce.
For some reasons I needed to reboot and shut down a couple of times today. No issues.

When viewing the log file, I noticed
"The User Data Access_4236e service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service."

Checking the 4 events (7031) immediately following my logoff instruction I found

0000: 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 U.s.e.r.D.a.t.a.
0010: 53 00 76 00 63 00 5F 00 34 00 32 00 33 00 36 00 S.v.c._.4.2.3.6.
0020: 65 00 00 00 e...

0000: 55 00 6E 00 69 00 73 00 74 00 6F 00 72 00 65 00 U.n.i.s.t.o.r.e.
0010: 53 00 76 00 63 00 5F 00 34 00 32 00 33 00 36 00 S.v.c._.4.2.3.6.
0020: 65 00 00 00 e...

0000: 50 00 69 00 6D 00 49 00 6E 00 64 00 65 00 78 00 P.i.m.I.n.d.e.x.
0010: 4D 00 61 00 69 00 6E 00 74 00 65 00 6E 00 61 00 M.a.i.n.t.e.n.a.
0020: 6E 00 63 00 65 00 53 00 76 00 63 00 5F 00 34 00 n.c.e.S.v.c._.4.
0030: 32 00 33 00 36 00 65 00 00 00 2.3.6.e...

0000: 4F 00 6E 00 65 00 53 00 79 00 6E 00 63 00 53 00 O.n.e.S.y.n.c.S.
0010: 76 00 63 00 5F 00 34 00 32 00 33 00 36 00 65 00 v.c._.4.2.3.6.e.
0020: 00 00 ..

Any suggestions??

Thanks
==
add the last part of the event log in PDF format, hope it can be viewed ...
==

Barman58 · 14 Aug 2016

You could go all old school on the problem - as this sort of issue is often caused by a running program refusing to shut-down you could switch off all background start-up items, which would hopefully remove the problem then you could activate one at a time until the problem returns - unfortunately this is likely to take a while with an intermittent issue like you have.

Autoruns from Microsoft will show and allow you to temporarily switch off any or all background operations.

There is also Process Monitor from the same MS Sysinternals Suite that can monitor the system over time to help trace the problem Process

The Sysinternals suite contains a wealth of small programs to dig into the internal processes of windows, and as also fully documented (which is not the case with other options)

Sysinternals Suite

tfwul · 14 Aug 2016

Thanks. Yes, I know about Sysinternals and autoruns. Then again, if I am looking at the blue 'Shutting Down' screen, I have no option but to push to powerbutton.

I see that the errors after my shuttdown instruction have something to do with

UserDataSvc_4236e
UnistoreSvc_4236e
PimIndexMaintenanceSvc_4236e
OneSyncSvc_4236e

Have no idea what these are about.

I wonder . . . the only difference was that I first shut down the pc and in the process of shutting it down, say within about 10 seconds or so, whilst walking away, I was passing my printer.
That went 'asleep' as I have not used it for a while.
To shut it down, I had to wake it up and then shut it down.
It is connected thru ethernet.

It is a lllong shot, but could thát have something to do with it?

=

Barman58 · 14 Aug 2016

it is a possibility that there is a link - I would expect it more with a USB connection than Ethernet

You could check the Ethernet card settings, there is often a Power option to allow computer to shut down device that might be causing confusion you could try toggling that if there,

There are also a lot of advanced NIC options that may include some type of "Keep Alive" option either at the computer or printer end.

I've also found this relating to the 7031 error http://answers.microsoft.com/en-us/w...1bac610?auth=1

it may help you pinpoint options for the services - perhaps changing the service "crash" options from re-start to close or something may help the shut-down to finish

tfwul · 15 Aug 2016

Many thanks for the above! I will check out the 7031 link.

[Off-topic]
If I filter on "Error" in the event log, quite a list is displayed. Although Windows is doing well, I am sometimes considering to a 'reset'.
Then again, frankly speaking, I wonder whether there is -anybody- running Windows 10, even a clean one, that has no 'errors' or 'warnings' at all.
I have a clean VM Windows 10 running, no applications installed, not even a 3rd party A/V, the desktop just shows the recycle.bin and 2x desktop.ini
Ah well, Start10 is installed, but that's it.
Nonetheless lists of 1014 DNS Client Events
But also Errors
Event 1008 Perflib
Event28 BTHUSB
Event219 Kernel-PnP
Event7031 Service Control
Event69 AppModel-Runtime
Event3 KernelEventTracing

All this just to say that I wonder whether it is possible to have an 'event log-error/warning free' windows 10...

Ah well...

Anyway, thanks for the tip on 7031 above.

=