Why a shutdown in Windows 8 / 10 is not a restart.


Recommended Posts

 

Ever since the dawn of the personal computer when a computer would act funny or miss-behave people would just turn the computer off (Sometimes for minutes or hours, when in fact the amount of time you leave it off makes no difference unless the issue is heat related) and turn it back on.

Starting with Windows 8, Microsoft wanted to make “Windows” Boot faster when you press the power button to turn it on (The time between pressing the power button and arriving at the desktop). To accomplish this they created “Fast startup”.

Fast startup is a shutdown + Hibernation Hybrid. First, let’s talk about what hibernation is and how it works.

Hibernation allows you to turn the computer completely off (even unplug it if you wish) and when you turn it back on, you are right back where you left off including all the applications you had open.

How does all this voodoo work? For hibernation to work, windows looks at how much Ram (memory) you have in your computer.

It then creates a file on your hard drive called HIBERFIL.SYS. Back in the days of Windows 2000 and Windows ME, this file was the exact same size as the amount of ram your computer has so if you had 2GB of ram you would of had a 2GB hiberfil.sys file. In Windows 7 they set the file size to 75% and in Windows 8 the file size is smaller yet, due to not hibernating user data during shutdown.

When you tell your computer to hibernate, it takes the contents of your ram and dumps it into the HIBERFIL.SYS file. Then the computer shuts off.

When you turn the computer back on, the reverse happens. It takes the contents of HIBERFIL.SYS and puts it back into ram and your computer is now booted. One reason this is faster is that typical spinning hard drives are much faster at large single files than thousands of small files.

Now that you know how hibernation works, let’s take a look at how fast startup works. The fast startup works by not hibernating the entire system but just the core functions, such as the kernel (the lowest level of the system), system drivers (software that tells your devices how to operate), and a few others.
.
When you turn your computer off in Windows 8 and Windows 10, it first closes all your applications, then it logs off and dumps the system files listed above into the HIBERFIL.SYS file and your machine shuts off.

When you turn the machine back on, it will start faster because half of the boot process is transferred directly back into ram, in the exact state it was in before the shutdown, problems and all.

This is also why when you select restart instead of shut down it feels like your system takes longer to startup. When you select restart nothing is hibernated and the system has to start everything from scratch.

Hopefully, you can see now why turning your computer off and back on in Windows 8 and Windows 10 is pretty worthless for solving any sort of problems and why it’s much better to select restart.

The issue I have with Fast Startup is that they told the average user NONE of this. How is the average person supposed to know that turning the computer off and back on won't solve their problem? After all, the process looks the same and it worked just fine in Windows 3.1, Windows 95, 98,ME, XP, Vista and Windows 7.

One customer was running Windows 8 and was having problems accessing their email. They were trying to open their email program but nothing was happening. I asked them if they restarted their computer and they told me yes, they turned the computer off 3 times and it still won't work. So I walked them through selecting "Restart" instead of "Shutdown" and after the "restart," their email opened up first try.

  • Like 4

Hello,

 

I have upgraded all of my computers to SSDs for at least their boot drives over the years, and find that booting from a powered down state to the logon screen to be fast enough that I disable the hibernation and suspend features of the operating system. 

 

One small bonus to this is that I gain the space back previously used by the HIBERFIL.SYS file on the boot drive (which can be considerable on workstations with 64-96GB of RAM), but the major reason I do this is to avoid incompatibilities with the computer's device drivers that sometimes do not handle the transitions between the different power/suspend states very well.

 

Regards,

 

Aryeh Goretsky

 

  • Like 2

Huh not something that I knew :)

 

Personally, being the family "IT guy", if someone has an issue, I always suggest a restart.  More than likely, the issue that they're having is something they want to try again ad see if it's been resolved so I haven't come across that "feature". 

 

Personally, given how little power is used during hibernation, most of the machines that I use frequently aren't ever shut down, they're either restarted or hibernated. 

 

MS should remove the other options from the power menu and keep just restart or hibernate. 

  On 06/09/2018 at 12:23, dipsylalapo said:

Huh not something that I knew :)

 

Personally, being the family "IT guy", if someone has an issue, I always suggest a restart.  More than likely, the issue that they're having is something they want to try again ad see if it's been resolved so I haven't come across that "feature". 

 

Personally, given how little power is used during hibernation, most of the machines that I use frequently aren't ever shut down, they're either restarted or hibernated. 

 

MS should remove the other options from the power menu and keep just restart or hibernate. 

Expand  

What about cases where you'd want a full shutdown (storm, machine move, hardware maint.)?

  On 04/09/2018 at 17:48, warwagon said:

It then creates a file on your hard drive called HIBERFIL.SYS. This file is the exact same size as the amount of ram your computer has.

Expand  

this is wrong.

on all my systems, where I leave hibernation enabled, the hiberfil.sys file is always much smaller than the amout of RAM in the system.

 

 -andy-

  On 06/09/2018 at 12:26, Squirrelington said:

What about cases where you'd want a full shutdown (storm, machine move, hardware maint.)?

Expand  

Fair points! I stand corrected!

  • Like 1
  On 06/09/2018 at 12:26, Squirrelington said:

What about cases where you'd want a full shutdown (storm, machine move, hardware maint.)?

Expand  

Hibernation is a full shut down. Sleep would not be, but Hibernation is. With Hibernation the computer is OFF!

  On 06/09/2018 at 12:27, AndyMutz said:

this is wrong.

on all my systems, where I leave hibernation enabled, the hiberfil.sys file is always much smaller than the amout of RAM in the system.

 

 -andy-

Expand  

I'll edit it. The size probably changes as to how much ram you are are using. After looking it up it appears that in windows 2000 the file was the entire size, but I guess it expands and contracts with other versions of windows.

  • Like 2
  On 06/09/2018 at 12:37, warwagon said:

Hibernation is a full shut down. Sleep would not be, but Hibernation is. With Hibernation the computer is OFF!

Expand  

So you could in theory disconnect from the power and move the machine etc. 

 

How would a machine deal with a hardware upgrade in hibernation?

  On 06/09/2018 at 12:39, dipsylalapo said:

So you could in theory disconnect from the power and move the machine etc. 

 

How would a machine deal with a hardware upgrade in hibernation?

Expand  

Yes, you can disconnect the power and move the computer. I'm curious, did you read the part where I explained how hibernation worked? lol

Always hated hibernation as most every machine I've ever owned, or worked on, had issues when resuming. One of the first things I always used to do was disable that crap! I'll either use sleep or turn the computer off when done. Have never left computers on, even over night! I'm on a different one or 2 every day anyway.

  On 06/09/2018 at 12:41, warwagon said:

Yes, you can disconnect the power and move the computer. I'm curious, did you read the part where I explained how hibernation worked? lol

Expand  

Just re-iterating what you said :rofl: 

 

What about hardware upgrades?

  On 06/09/2018 at 12:55, dipsylalapo said:

Just re-iterating what you said :rofl: 

 

What about hardware upgrades?

Expand  

My guess would be yes. Because most people wouldn't know they are in a hybrid state and would always turn the computer off to upgrade their hardware.

 

That being said, if you want to clone a Windows 8 or 10 hard drive with true image, it will bomb out almost instantly if you just turn the computer off, pull the drive in and clone on another machine. If you are pulling the drive, either turn hibernation off, or restart and when the computer starts to come back on turn it off and then pull the drive.

Was doing remote support with someone who was having issues with their usb printer printing. It would print but it would take a few mins. Looked at the system boot time and it was 8/16/2018. I asked him when the last time he restarted it was (which obviously was 8/16/2018) he said "I just turned it on today" So I had to explain to him the difference between a shutdown and restart.

  On 06/09/2018 at 12:26, Squirrelington said:

What about cases where you'd want a full shutdown (storm, machine move, hardware maint.)?

Expand  

Win 10 - I had a game where it crashed and the sound was "stuck". Powered down, powered back up, stuck sound came back.
It wasn't until I did a "restart" no longer hearing the stuck sound.

Hello,

 

On Windows 10 (and perhaps earlier), you can adjust the size of the hibernation file so it is a percentage of RAM (as low as 40%).  For more information open an elevated Command Prompt (filename: CMD.EXE) and type in "POWERCFG /HIBERNATE ?" (without the quotes) and press Enter to see all of the options and their associated values.

 

Regards,

 

Aryeh Goretsky

 

 

  On 06/09/2018 at 12:27, AndyMutz said:

this is wrong.

on all my systems, where I leave hibernation enabled, the hiberfil.sys file is always much smaller than the amout of RAM in the system.

 

 -andy-

Expand  

 

  • +Warwagon unlocked this topic

When first connecting to someone's computer for "Any" issue, I first open CMD and run  systeminfo to look at the "System boot time". If "Fast startup" is enabled the date will not change each time the computer is turned on and off, only when the computer is restarted.

 

Here is an example. My basement workstation has fast startup enabled and I JUST booted it up today 1/24/2022 at 3:30pm. Lets look at the system boot time. Even though I just turned it on, the machine hasn't actually been restarted since 1/18/2022.

 

image.png.fd9dbcdc9ce8875f0247c6d7f8aa3fd5.png

 

There have been times when the "System boot time" has been MONTHS ago!

I always initiate from an elevated command prompt powercfg -h off enter, reboot.  

 

The hiberfil.sys is notorious for corruption.

  • Like 3
  On 24/01/2022 at 21:40, xrobwx71 said:

I always initiate from an elevated command prompt powercfg -h off enter, reboot.  

 

The hiberfil.sys is notorious for corruption.

Expand  

This! I do that too on "Most" of my machines.

  On 24/01/2022 at 21:34, warwagon said:

When first connecting to someone's computer for "Any" issue, I first open CMD and run  systeminfo to look at the "System boot time". If "Fast startup" is enabled the date will not change each time the computer is turned on and off, only when the computer is restarted.

 

Here is an example. My basement workstation has fast startup enabled and I JUST booted it up today 1/24/2022 at 3:30pm. Lets look at the system boot time. Even though I just turned it on, the machine hasn't actually been restarted since 1/18/2022.

 

image.png.fd9dbcdc9ce8875f0247c6d7f8aa3fd5.png

 

There have been times when the "System boot time" has been MONTHS ago!

Expand  

Same. I find this commonly has caused issues for people with laptops who take it back/forth to the office, especially when group policy is involved, drive mappings, and the sort.

 

This is also why I don't even ask if people have restarted their computer anymore, mostly because they'll say yes when they've simply shut it down, assuming that restart and shutdown still mean the same thing. Anyway, disabling Fast Boot often times resolves those recurring issues.

  • Like 2
  On 24/01/2022 at 21:40, xrobwx71 said:

I always initiate from an elevated command prompt powercfg -h off enter, reboot.  

 

The hiberfil.sys is notorious for corruption.

Expand  

I do the same for every new install of Windows 8 and newer versions

 

This is what I use: powercfg /hibernate off

 

I did not know that h would do the same thing...

First thing I do with a system with a SSD is go into the power options and disable fast startup. I can live with a couple extra seconds and avoid the headaches when I have to pull data off a dead PC. Fast startup is a sloppy hack, IMO. 

 

Microsoft has 3 decades of OS development experience. They know how to make a good OS. Its time to stop cutting them slack.

 

And no, I can't do better and no I don't code. That's what the brainiacs of this multi-billion dollar company are supposed to be for.

Edited by JustGeorge
  On 26/01/2022 at 00:58, aioraito said:

I do the same for every new install of Windows 8 and newer versions

 

This is what I use: powercfg /hibernate off

 

I did not know that h would do the same thing...

Expand  

-h not just h. But yes, it does.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Hundreds of printer models with weak password algorithms exposed, no firmware patch possible by Usama Jawad Many people don't think or care about it, but printer security is a pretty important avenue when it comes to evaluating your cybersecurity posture. Last month, it was found that the companion software for Procolored printers was distributing malware. Now, it has been revealed that hundreds of printer models all over the globe are susceptible to attacks targeting their admin credentials. Bleeping Computer has reported that CVE-2024-51978 is a one of the eight printer vulnerabilities recently discovered by security researchers. Combined, these allow authenticated and unauthenticated attackers to discover the default admin password, perform remote code execution (RCE), crash the printer, and leak other sensitive information. Severity ratings go from a score of 5.3 (medium) to 9.8 (critical), indicating that these are pretty severe vulnerabilities. The most dangerous vulnerability in there exposes the default admin password, and primarily affects Brother printers. This is because Brother utilizes a rather weak password generation algorithm that is highly dependent upon the device's serial number and a static salt table. Analysis of the code revealed that the first 16 characters of the serial number are appended with eight bytes from a static salt table, with the results being hashed with SHA256 and Base64-encoded. Finally, the first eight characters are then taken and some of them are replaced with special characters to form the password. The static nature of the password generation algorithm means that an attacker can chain various existing vulnerabilities to get access to your serial number and eventually your default admin password. It is important to note that not all printer models are affected by all of these flaws, but the default admin password exposure does affect 695 models. The breakdown for the number of printer model affected by the eight vulnerabilities is as follows: Brother: 689 Fujifilm: 46 Konica Minolta: 6 Ricoh: 5 Toshiba: 2 Brother has informed the security researchers that it cannot fully remediate the password generation vulnerability through a firmware patch. It can only fix the issue in its next printer models by patching the problem during the manufacturing process. This makes it crucial for customers of affected models to change their default admin password as soon as possible, which is good practice anyway.
    • Win11 being 2.3x faster than Win10, so that means without changing any hardware, Doom Eternal will run at over 2x the framerate? Or that any computational stuff will be done 2x faster just because of OS? Press X for doubt. I wonder where they pulled these metrics out of coz they make no sense. Not to mention my laptop with Ryzen 2500U that used to run Windows 11 simply CAN'T anymore because of BS arbitrary requirements Microsoft has imposed in Win11 that weren't there intiially. So, that laptop is now running Ubuntu or Fedora and runs at 1000000000000000000000x faster speeds because Windows 11 just doesn't work at all so it gets DNF.
    • “Ask Photos” is coming to more Google Photos users in the US by Paul Hill Google has announced several improvements to a Gemini-powered Google Photos feature called Ask Photos. The feature launched last year in early access and it was great for longer search requests, however, when users typed “Dog” or “Beach” looking for those types of pictures, Ask Photos underperformed. Now, Google has addressed this and is bringing the feature to more eligible users in the United States. The search giant said that users enjoyed asking queries such as “suggest photos that’d make great phone backgrounds” or “what did I eat on my trip to Barcelona?” and getting Gemini-powered responses to these complex questions. Unfortunately, simple searches like “beach” or “dogs” were generating less than optimal results and people complained. To remedy the situation, Google has brought the best of Google Photos’ classic search feature to Ask Photos to improve latency. Easy, short requests will be dealt with by the old search mechanism and when you ask complex queries, it will switch over to the Gemini-powered search results. Now that Google has addressed this main issue of simple searches by integrated functionality from the previous search model, the company feels more confident to open up beyond early access and deliver it to more users in the United States. To be eligible, you must be 18+, be in the US, have your Google Account language set to English (United States), and have Face Groups turned on. This feature is only available on Android and iOS. To start using it, open Google Photos and tap on Ask at the bottom, then press Try now and agree to the terms. If you do not see the Ask button, it means you’re not yet eligible. The feature also can’t be used on computers yet. Hopefully, Google will quickly expand this feature outside the US so that international users can try it out too.
    • When are MS going to learn. Traditional home users who email, watch cat videos and perform basic tasks don't care if W11 is slightly faster...assuming it's true. Few home users care about faster speed and more secure claims. In any event, it's irrelevant. MS stopped caring about home users years ago as evident by their hostile, anti choice home user policies.
    • They have. https://www.xda-developers.com...-25h2-update-kind-of-small/
  • Recent Achievements

    • Week One Done
      suprememobiles earned a badge
      Week One Done
    • Week One Done
      Marites earned a badge
      Week One Done
    • One Year In
      runge100 earned a badge
      One Year In
    • One Month Later
      runge100 earned a badge
      One Month Later
    • One Month Later
      jfam earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      567
    2. 2
      +FloatingFatMan
      177
    3. 3
      ATLien_0
      169
    4. 4
      Michael Scrip
      127
    5. 5
      Xenon
      119
  • Tell a friend

    Love Neowin? Tell a friend!