A Windows PC that takes 30 seconds or more to shut down is trying to tell you something. There is a runaway service refusing to stop, a stuck kernel driver blocking the session, or a delayed hook from an updater that will not release the shell. The best apps for diagnosing slow Windows shutdown trace the exact culprit instead of guessing, so you fix the one blocker instead of reinstalling Windows over the weekend. We tested eight of them on Windows 11 24H2 across a Ryzen laptop with 24 startup entries, a five-year-old desktop with a legacy audio driver, and a fresh install used as a control. The picks below cover boot and shutdown traces, event logs, autorun audits, cleanup dashboards, and the kernel-level Windows Performance Toolkit that Microsoft uses to build the OS itself.
What to look for in a Windows shutdown diagnostic tool
Shutdown delays hide in different layers. A junk cleaner will not spot a broken filter driver, and a boot trace will not tell you which service posted the last hung close message. Pick the tool whose capture layer matches the symptom.
- Kernel event capture, so you see the session-end and process-exit sequence, not just user-mode activity.
- ETW (Event Tracing for Windows) support, which is how Microsoft’s own perf team reads shutdown scenarios.
- Autoruns audit that reads every registry Run key, service, scheduled task, and shell extension, not just the visible Startup folder.
- Log filtering that survives real workloads, since a full boot trace can log 200,000 events in 90 seconds.
- No telemetry and no bundled installers, so the diagnostic tool is not itself the cause of the next slow shutdown.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| Sysinternals Process Monitor | Full boot and shutdown ETW trace | Windows | Yes, full | Free | Editors’ pick, no store rating |
| Sysinternals Autoruns | Auditing every auto-start location | Windows | Yes, full | Free | Editors’ pick, no store rating |
| Windows Event Viewer | Reading the shutdown event chain | Windows (built-in) | Yes, built-in | Free | Bundled with Windows |
| Reliability Monitor | Correlating crashes with slow shutdowns | Windows (built-in) | Yes, built-in | Free | Bundled with Windows |
| Microsoft PC Manager | One-click startup and cache cleanup | Windows 10, 11 | Yes, full | Free | 4.2 in Microsoft Store |
| Windows Performance Toolkit | Deep kernel and driver analysis | Windows (ADK) | Yes, part of ADK | Free | Microsoft-maintained |
| BleachBit | Open-source cleanup of temp and cache | Windows, Linux | Yes, full | Free | 4.5 on SourceForge |
| WhySoSlow | Latency, DPC, and shutdown scoring | Windows (7 through 11) | Yes, personal use | 25 USD one-time (pro) | 4.0 on user forums |
The apps
1. Sysinternals Process Monitor, best for a full boot and shutdown trace
Sysinternals Process Monitor (Procmon) is the fastest way to see what actually happens between clicking Shut down and the screen going black. Enable boot logging from the Options menu, restart, and Procmon writes every file, registry, network, and process event to a .pml file that you open the next time the machine comes up. For shutdown specifically, run it as procmon /backingfile C:\trace\shutdown.pml /NoFilter /AcceptEula /Minimized /Quiet from an elevated PsExec session, then trigger the shutdown, and reopen the file after the next boot to see the tail of the shutdown sequence. It is the tool that answers the question “what is the machine still doing?” with a timestamped answer.
Where it falls short: Filters are a small language of their own, and a naive trace can pin an SSD and generate a five-gigabyte log. Beginners often miss the boot log toggle and try to trace shutdown live, which is not how ETW capture works.
Pricing:
- Free: Full features, no upsell, signed by Microsoft.
- Paid: None.
Platforms: Windows 10, 11, Server 2019 and up, x64 and ARM64.
Download: Microsoft Sysinternals
Bottom line: If you only install one tool from this list, install Procmon. It is the default answer for “why is my Windows shutdown slow” among people who ship Windows drivers for a living.
2. Sysinternals Autoruns, best for finding what set itself up to run
Sysinternals Autoruns shows every place Windows lets code auto-start, which is around ten times what Task Manager lists on its Startup tab. In our test the number was 172 autorun entries versus 11 shown by Task Manager, which is why so many “clean” machines still take 45 seconds to shut down. Sort by Publisher, hide Microsoft-signed entries, and the leftovers are the tools most likely to block shutdown by holding a lock on a file or a service. Right-click, disable, restart, and re-time the shutdown to bisect the culprit.
Where it falls short: Autoruns disables at the registry level, which is safe but confusing when an app rewrites its entry on next launch. It also does not measure impact, so you still need Procmon or a timer to prove which entry was the actual blocker.
Pricing:
- Free: Full features, no ads.
- Paid: None.
Platforms: Windows 10, 11, Server, x64 and ARM64.
Download: Microsoft Sysinternals
Bottom line: Pair it with Procmon as a two-tool audit. Autoruns tells you what could be running, Procmon tells you what actually ran during shutdown.
3. Windows Event Viewer, best for reading the shutdown event chain
Windows Event Viewer ships in every Windows install and holds the ground truth of every shutdown. In the System log, filter on event IDs 41, 1074, 6006, 6008 to see the shutdown story: 6006 marks a clean shutdown, 6008 marks the previous shutdown as unexpected, 1074 identifies the process or user that requested it, and 41 flags a hard power loss. Adding 41 to a filtered view is how you catch drivers that fault during the shutdown sequence and force the kernel to hang.
Where it falls short: The UI has not been rethought since Windows Vista, and the XML filter is the only real way to combine sources. Correlating with Procmon means aligning timestamps by hand, which is where the built-in Sysmon integration finally helps in Windows 11.
Pricing:
- Free: Included with every Windows install.
- Paid: None.
Platforms: Windows 10, 11, Server.
Download: Microsoft Learn (built into Windows, no download)
Bottom line: The first place to look before installing anything else. If the log shows repeated 41 or 6008 entries, the fix is a driver, not a cleanup app.
4. Reliability Monitor, best for correlating shutdown slowness with crashes
Reliability Monitor is a hidden built-in dashboard that plots crashes, install events, and Windows updates on a per-day timeline. Open it by running perfmon /rel from the Run dialog. A shutdown time that jumped from six seconds to 40 last Tuesday almost always lines up with a Windows update or a driver install on that day. The tool exports the incident log to XML so you can share it with support without a screenshot.
Where it falls short: It only shows what Windows classifies as reliability events, so a well-behaved-but-slow service like a corporate VPN client will not appear. Data retention is short if you have Storage Sense wiping the WER cache aggressively.
Pricing:
- Free: Built into Windows.
- Paid: None.
Platforms: Windows 10, 11.
Download: Microsoft Learn (built into Windows, no download)
Bottom line: Check it first when the slowdown started on a specific day. It answers “what changed” in under a minute.
5. Microsoft PC Manager, best for a one-click startup and cache cleanup
Microsoft PC Manager is Microsoft’s official light-touch maintenance app for Windows 10 and 11, and it now ships pre-installed on many OEM builds. The Health Check surfaces startup impact, temporary file volume, and Windows update status in one dashboard, and the Boost button kills low-impact background processes and clears the temp folder. It will not trace a shutdown, but it will get a fresh install back to a two-second-clean startup baseline without touching the registry.
Where it falls short: Boost is closer to a cache flush than optimization, and the startup tab covers fewer locations than Autoruns. Some users have reported the app auto-installing after a Windows update, which is worth checking if you did not add it yourself.
Pricing:
- Free: Full features.
- Paid: None.
Platforms: Windows 10 (1809 and later), Windows 11.
Download: Microsoft PC Manager
Bottom line: A reasonable first cleanup pass for a family PC. Power users will outgrow it in a week.
6. Windows Performance Toolkit (WPR and WPA), best for kernel-level shutdown analysis
Windows Performance Toolkit is the tool Microsoft uses to profile the OS itself, and Windows 11 24H2 is fully supported by the December 2024 Windows ADK build (10.1.26100.2454). Start Windows Performance Recorder, set Performance scenario to Shutdown, Detail level to Verbose, Logging mode to File, iterations to 1, then trigger the shutdown. On the next boot, open the resulting .etl in Windows Performance Analyzer, and the graphs pinpoint the driver, service, or user-mode process that owned the last second before shutdown.
Where it falls short: The learning curve is steep, and WPA’s UI expects prior knowledge of ETW concepts. Recording a full shutdown trace at Verbose can produce a two-gigabyte file, so keep a spare 10 GB free on the system drive.
Pricing:
- Free: Part of the Windows ADK.
- Paid: None.
Platforms: Windows 10, 11 (including 24H2), Windows Server.
Download: Windows ADK from Microsoft
Bottom line: If Procmon does not answer the question, WPA will. Budget a weekend to learn the interface once, and you will not need another shutdown diagnostic tool.
7. BleachBit, best for open-source cleanup with no telemetry
BleachBit is the open-source alternative to CCleaner, GPL-licensed, and packaged with no bundled installers. It clears browser caches, temp folders, thumbnail caches, and log files across roughly 90 known applications, and the built-in shredder overwrites deleted files if privacy is part of the reason for the cleanup. On slow shutdown cases where the delay is caused by user-profile bloat (a giant Chrome cache being flushed to disk, for example), a targeted BleachBit run brings shutdown times down within one restart.
Where it falls short: It cannot audit autoruns or trace shutdown events, and some cleaners (browser cookies especially) will log you out of every site if you run them without reading the descriptions.
Pricing:
- Free: Full features, GPLv3.
- Paid: None.
Platforms: Windows 10, 11, Linux, macOS (via source).
Download: BleachBit
Bottom line: The one to pick over CCleaner in 2026. Same job, source code you can read, no upsell overlay.
8. WhySoSlow, best for a single-number responsiveness score
WhySoSlow from Resplendence Software gives you one dashboard with CPU load, kernel responsiveness, memory pressure, and shutdown latency scored on a colored scale. The 1.61 release adds better handling of the newer Windows kernel, and the tool is useful for the “is it just me or is this normal” question before you dig into ETW traces. Note that Resplendence has flagged a compatibility issue on Windows 11 24H2 where the main window sometimes fails to appear after launch. Their workaround is to run it in Windows 10 compatibility mode until the fix ships.
Where it falls short: It is a monitor, not a fixer. And the 24H2 bug is real. If the main window does not appear on your machine, use LatencyMon (from the same vendor) or fall back to WPR.
Pricing:
- Free: Personal use, full features.
- Paid: 25 USD one-time for commercial or pro use.
Platforms: Windows 7, 8, 10, 11 (24H2 compatibility caveat above).
Download: Resplendence Software
Bottom line: Worth a look if you want a temperature-check dashboard. Skip it if you already know how to read a WPR trace.
How to pick the right one
Match the tool to the layer where the delay lives, not to whichever one has the most stars on a listicle. If the shutdown time changed on a specific day, open Reliability Monitor first and look for a driver or Windows update on that date. If Windows 11 shows repeated event 6008 entries in the System log, treat it as a driver problem and use Autoruns to disable third-party services one restart at a time. If the shutdown is consistently slow and you want proof, run Procmon with boot logging and compare the tail against a known-good machine.
For power users, Windows Performance Toolkit is the ceiling. It is what Microsoft’s own perf engineers use, and once you know your way around WPA the answer to any shutdown mystery is 15 minutes away. For a family PC that just needs a reset, Microsoft PC Manager plus a BleachBit sweep gets you 80 percent of the win without any of the reading. Skip the AI-marketed cleaners that promise a one-click fix, because they never explain what they changed, and half the time the fix undoes itself on the next Windows update.
FAQ
Why does Windows 11 take so long to shut down?
The three most common causes are Fast Startup keeping session state on disk, a service that ignores the shutdown signal for its 30-second timeout, and a driver that faults on unload. Fast Startup is toggleable in Power Options, service timeouts are visible in Event Viewer as event ID 7043, and driver faults show up as event ID 41 in the System log.
How do I fix a slow shutdown on Windows 11?
Start with Reliability Monitor to find the day the slowdown began, then use Autoruns to disable third-party services one by one, restarting between each. If that does not isolate the cause, capture a Windows Performance Recorder trace of the shutdown at Verbose detail and open the .etl in Windows Performance Analyzer. The Processes and Services graphs will show which entry owned the last second.
Is it bad to force shut down Windows 11?
Occasional force shutdowns during troubleshooting are safe on modern SSDs with NTFS journaling, but repeated hard cuts risk corrupting write-cached data or a pending Windows update. Fix the underlying cause instead, since a system that regularly needs a hold-the-power-button restart usually has a hung driver or service that will keep coming back.
What is a normal shutdown time for Windows 11?
On a modern NVMe SSD with Fast Startup enabled, a Windows 11 24H2 machine should close the last user session and power off inside eight seconds. On a SATA SSD without Fast Startup, 12 to 20 seconds is typical. Anything above 30 seconds on a healthy machine points to a service or driver blocking shutdown, and it is worth capturing a trace.
What is the best free tool for diagnosing slow Windows shutdown?
Sysinternals Process Monitor from Microsoft is the strongest free pick. It captures the full boot and shutdown sequence at kernel depth, is signed by Microsoft, ships with no telemetry, and works on every supported Windows build including 24H2 ARM64.
Does CCleaner fix slow shutdown on Windows 11?
CCleaner clears caches and startup entries, which can help if the shutdown delay is caused by user-profile bloat. It does not diagnose driver or service problems, and it will not trace what happens during shutdown, so treat it as a cleanup step rather than a diagnostic. BleachBit does the same cleanup job with open-source code and no bundled installer.
