sessionShutdown sessionID="0" duration="1513">
The value sessionShutdown sessionID="0" shows the servicesShutdownDuration. So you can see which service takes too long to stop.
What Happens in SystemSession
This phase includes two subphases:
• Preshutdown notification. Windows serially shuts down all services that registered to receive preshutdown notifications. Ordered services—services that have set up the shutdown order of dependent services—are shut down before non-ordered services.
• Shutdown notification. All services that registered to receive shutdown notifications are shut down in parallel.
If all services have not exited after 20 seconds (in Windows Vista) or 12 seconds (in Windows 7), the system continues the shutdown. Processes and services that do not shut down in a timely manner are left running as the system shuts down.
SystemSession Performance Vulnerabilities
In the preshutdown notification subphase, the SCM serializes the waits. Therefore, these services block system shutdown until they exit or until the wait hint time-out expires.
Services are not guaranteed to have enough time to finish all their work in the shutdown notification subphase before the system shuts down.
In both cases expand the node and look at the shutdownDuration value.
It helps you to identify a hanging application are service.
What Happens in KernelShutdown
In the KernelShutdown phase, the rest of the system, including all devices and drivers, is shut down.
To calculate the time spent in KernelShutdown, subtract the time that is required to shut down the system and user sessions from shutdownTime.
In my example:
KernelShutdown = 23184 - 3321 - 1513 = 18350
In this case the 18.35 seconds are very slow. In the <interval> you see an entry ZeroHiberFile which takes too long. In this expample the user enabled the Option ClearPageFileAtShutdown under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management to 1. This overrides the hiberbation file with 0 to delete personal data. This causes the huge slowdown. Setting this option to 0 would save 12.64 seconds of shutdown time.
That is all you need to analyze slow shutdown issues.