Open the XML and you see this:
It shows you the most relevant data.
<timing shutdownTime="23184" servicesShutdownDuration="1513">
The shutdownTime is in this example 23s. Stopping the services takes 1.5s which is fast.
Next you have an entry for all sessions. Starting with Vista, all services run in Session 0 (Session 0 Isolation) and each user gets his one Session (1,2,..,n).
sessionShutdown sessionID="1" duration="3321">
shows the time which it takes to stop all applications which the user is running. In this example it takes 3.3seconds.
What Happens in UserSession
During this phase, the Client/Server Runtime Server Subsystem (Csrss.exe) shuts down all applications that are running in the user session—that is, all applications that have session ID 1.
If after 5 seconds any application blocks shut down, Windows displays the dialog box in Figure 24 so that users can choose to force or cancel shutdown.
UserSession Performance Vulnerabilities
Because Windows serially shuts down applications, any delay in a process’s shutdown path contributes to the total shutdown duration. To ensure a speedy shutdown, every application must respond quickly to shutdown notification messages (WM_QUERYENDSESSION and WM_ENDSESSION).
Windows uses long time-outs so that applications have sufficient time to shut down and save user data. Therefore, applications can have a significant effect on shutdown performance.