An XDA piece pointed at a single Windows diagnostic that answers why your PC takes forever to shut down: Event Viewer’s built-in “Diagnostics-Performance” log, which records boot and shutdown durations and names the process that dragged them out. It works, but Event Viewer is a big house with a narrow door. These eight desktop tools go from “here’s the log” to “here’s the fix” in fewer clicks. Every one of them is free, and every one of them is worth having on the machine before the next slow shutdown.
What to look for in a Windows diagnostics app
Six criteria we used when ranking:
- Points at the actual process, not just the timestamp. “SessionEnd took 43s” isn’t a fix; “Steam client took 43s” is.
- Ships from a source you already trust. Sysinternals, Microsoft, and NirSoft are the safe list.
- Doesn’t slow the machine further. A profiler that costs 10% CPU while running is a poor trade.
- Zero-install where possible. Sysinternals tools run from a folder; nothing to uninstall.
- Reads the Event Viewer log without making you learn Event Viewer.
- Works offline. Diagnostics on a fresh install with no internet is when you need them most.
Quick comparison
| App | Best for | Free plan | Starting price | Rating |
|---|---|---|---|---|
| Event Viewer | Built-in shutdown/boot log | Yes | Free | Ships with Windows |
| Process Monitor | Deep filesystem and registry trace | Yes | Free | Filter shutdown activity by process |
| Autoruns | Everything that runs at boot or shutdown | Yes | Free | Disables autoruns in one click |
| WhySoSlow | Real-time responsiveness monitor | Yes | Around $29 (Pro) | Live view of shutdown lag causes |
| BlueScreenView | Reads BSOD minidumps | Yes | Free | Parses .dmp files without a debugger |
| Task Manager | Startup impact ratings | Yes | Free | Built-in startup timing |
| Reliability Monitor | Historical crash/hang timeline | Yes | Free | Correlates events with software installs |
| Windows Performance Toolkit | Full trace with WPA | Yes | Free (Windows SDK) | The tool Microsoft engineers use |
The apps
1. Event Viewer, best built-in shutdown log
Event Viewer ships in every Windows install. Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational holds every boot and shutdown timing. Filter for Event ID 203 to see shutdown reasons and durations. Event Viewer for Windows shutdown diagnostics is the answer XDA pointed at, and it’s the correct first stop.
Where it falls short: the interface is 20 years old and the search only reads what you already know to filter for.
Pricing: free, ships with Windows.
Platforms: Windows 10, Windows 11, Windows Server.
Download: Already installed. Run eventvwr.msc from the Start menu.
Bottom line: always the first tool to open. Everything below either builds on it or covers what it misses.
2. Process Monitor, best deep trace
Process Monitor (ProcMon) from Sysinternals records every filesystem, registry, and process event in real time. Turn it on before a slow shutdown, save the trace, filter for the shutdown window. Process Monitor for Windows shutdown diagnostics reveals what a stuck driver or antivirus scan is actually blocking on.
Where it falls short: traces balloon fast; a 30-second capture can be gigabytes. Filters are essential.
Pricing: free, from Microsoft’s Sysinternals suite.
Platforms: Windows 10, Windows 11, Windows Server.
Download: Microsoft Sysinternals
Bottom line: the tool for when Event Viewer says “something took 30 seconds” and doesn’t say what.
3. Autoruns, best for shutdown-time services
Autoruns lists every place Windows loads code from at boot: services, scheduled tasks, shell extensions, browser add-ons, drivers. A shutdown that hangs often hangs on a shutdown-time task registered by a program the user forgot they installed. Autoruns for Windows shutdown diagnostics is where those get named.
Where it falls short: cropped to what’s registered; a rogue app that grabs the shutdown event without registering won’t show here.
Pricing: free, Sysinternals.
Platforms: Windows 10, Windows 11, Windows Server.
Download: Microsoft Sysinternals
Bottom line: run before every “clean up my startup” session.
4. WhySoSlow, best real-time responsiveness monitor
WhySoSlow from Resplendence Software watches CPU load, DPC/ISR latency, and system responsiveness in real time. When a shutdown drags, WhySoSlow shows the spike as it happens. WhySoSlow for Windows shutdown diagnostics is worth pinning while investigating.
Where it falls short: the free tier limits history depth and log export. Pro is a modest one-time license.
Pricing:
- Free: real-time monitor, basic export.
- Paid: around thirty dollars for the Pro license.
Platforms: Windows 10, Windows 11.
Download: Resplendence Software
Bottom line: pick this when the slowdown pattern is intermittent and Event Viewer only confirms it happened.
5. BlueScreenView, best BSOD minidump reader
BlueScreenView from NirSoft opens the .dmp minidump files Windows writes when it bluescreens (often the ugly end of a hung shutdown). It names the driver and highlights the stack frame at the top of the crash. BlueScreenView for Windows shutdown diagnostics is the fast path from “crashed on shutdown” to “here’s the driver to update”.
Where it falls short: minidump analysis is heuristic; a full crash-dump investigation still needs WinDbg.
Pricing: free, NirSoft.
Platforms: Windows 10, Windows 11.
Download: NirSoft BlueScreenView
Bottom line: pick this the first time a shutdown ends in a BSOD instead of a clean poweroff.
6. Task Manager, best built-in startup impact view
Task Manager on Windows 11 shows a Startup Apps tab with an “Impact” rating (Low, Medium, High) and a startup type. Programs with High impact on startup often have matching shutdown-time hooks that add just as much delay. Task Manager for Windows shutdown diagnostics is the “no download” pass before pulling in Autoruns.
Where it falls short: doesn’t show shutdown time specifically; you infer from the boot impact.
Pricing: free, ships with Windows.
Platforms: Windows 10, Windows 11.
Download: Already installed. Ctrl+Shift+Esc.
Bottom line: the two-click check before doing anything else.
7. Reliability Monitor, best historical timeline
Reliability Monitor (Control Panel → Security and Maintenance → View reliability history) plots a stability index over time and lays crashes, hangs, and warnings against it. Correlate a slow-shutdown streak with the app you installed that week. Reliability Monitor for Windows shutdown diagnostics is the pattern-finder Event Viewer isn’t.
Where it falls short: less detail per event than Event Viewer, and it hides in Control Panel where nobody visits.
Pricing: free, ships with Windows.
Platforms: Windows 10, Windows 11.
Download: Already installed. Run perfmon /rel.
Bottom line: open once a month to spot which install broke the shutdown time.
8. Windows Performance Toolkit (WPA), best full trace
Windows Performance Toolkit with the Windows Performance Analyzer (WPA) is what Microsoft engineers use to profile Windows itself. Capture a boot or shutdown trace with xperf, open it in WPA, and every millisecond is accounted for. WPA for Windows shutdown diagnostics is the ceiling of what free tools can tell you.
Where it falls short: steep learning curve. The tool assumes you know what “shutdown phase” a process is in.
Pricing: free, part of the Windows SDK / Assessment and Deployment Kit.
Platforms: Windows 10, Windows 11, Windows Server.
Download: Windows ADK from Microsoft
Bottom line: pick this when the eight tools above haven’t answered the question and you need to go all the way in.
How to pick the right one
- Start with Event Viewer’s Diagnostics-Performance log. Note the durations.
- If a process is named but you don’t know what it is: Autoruns and Task Manager.
- If Event Viewer named a duration but no process: Process Monitor for the trace.
- If a shutdown occasionally ends in a BSOD: BlueScreenView on the minidump.
- If the slowdown started this month: Reliability Monitor to date-anchor it against installs.
- If you want to catch it live: WhySoSlow running in the tray.
- If nothing works: Windows Performance Toolkit trace, opened in WPA.
FAQ
Which Event Viewer log records shutdown times?
Applications and Services Logs → Microsoft → Windows → Diagnostics-Performance → Operational. Filter for Event ID 203 for shutdown, Event ID 100 for boot. Each entry lists total duration and, where identifiable, the delaying process.
Are Sysinternals tools safe to install on a work laptop?
Yes. Sysinternals is a Microsoft-owned suite, and Autoruns, Process Monitor, and the rest are on the standard allow list for most IT departments. They run without installation from any folder.
What is the free equivalent of paid Windows diagnostic suites?
The combination of Event Viewer, Process Monitor, Autoruns, Reliability Monitor, Task Manager, and BlueScreenView covers what commercial diagnostic bundles offer. All are free from Microsoft or NirSoft.
Do these tools work on Windows Server?
Event Viewer, Process Monitor, Autoruns, Task Manager, Reliability Monitor, and the Windows Performance Toolkit all run on current Windows Server releases. WhySoSlow and BlueScreenView are client-focused but function on Server.
Can I read the shutdown log remotely?
Yes. Event Viewer supports connecting to a remote machine (File → Connect to Another Computer). Sysinternals PsLoglist prints Event Viewer entries from a remote host to the console.
What is the fastest single check for slow shutdown?
Open Event Viewer, filter Diagnostics-Performance → Operational for Event ID 203, look at the most recent shutdown’s Total Time and the “Program that caused this delay”. Ninety percent of the time that names the culprit.
