Use Shutdown Actions in Process Explorer

Learn how to use Process Explorer's File > Shutdown menu to lock, log off, sleep, hibernate, restart, or shut down Windows safely.

Process Explorer is a Windows system utility for viewing and managing processes. It also provides system and user-session controls through its File menu. These commands can affect the current Windows session or the entire computer, depending on the action selected.

A shutdown action is different from terminating a process. A process operation affects one program or service, while a shutdown action changes the state of a user session or the whole operating system. For process-specific operations, see Process Explorer process actions and how to kill a process.

Find the Shutdown menu

Open Process Explorer.
Select File on the menu bar.
Point to or select Shutdown.
Choose the required action from the submenu.

The navigation path is File > Shutdown. The exact labels and available commands can vary by Windows version, hardware and firmware support, power settings, local security policy, administrator permissions, remote-session restrictions, and organizational device management.

Shutdown actions at a glance

Action	What happens to the current session	Computer power state	Typical use case	Key caution
Shut Down	Windows closes the session and applications.	Computer powers off.	Taking a computer out of service.	Other signed-in users, services, and workloads may be disrupted.
Restart	Windows closes the session and starts it again.	Computer reboots.	Applying updates or recovering from a system problem.	Save work and check active workloads first.
Log Off	Only the current user's session ends; its applications close.	Computer remains powered on.	Ending work for one account or switching users.	Unsaved work may be lost.
Lock	Session and applications remain open.	Computer remains powered on.	Temporarily leaving a workstation.	Another person still needs an authorized sign-in method to use the session.
Hibernate	Session state is saved to storage for later restoration.	Computer powers off.	Transporting a laptop while preserving open work.	Available only when supported and enabled.
Suspend/Sleep	Session remains in memory for quick resumption.	Computer enters a low-power state.	Taking a short break from a laptop or workstation.	Normally depends on continued power to preserve the in-memory session.

Shut Down

Shut Down closes Windows and powers off the computer. Windows may ask applications to close or display prompts for unsaved work before completing the operation.

Use this action when the computer should be fully powered off, such as when taking it out of service after saving work. A shutdown can affect other signed-in users, remote connections, services, virtual machines, downloads, databases, and shared workloads. Administrative permissions or organizational policy may restrict the command.

Restart

Restart closes the current Windows session, powers through a reboot cycle, and loads Windows again. It is commonly used to complete updates or software installation, reload system components, or recover from certain system problems.

Save documents and check active workloads before restarting. A reboot can interrupt long-running programs, remote sessions, file transfers, virtual machines, and services.

Log Off

Log Off ends the current user's Windows session without necessarily powering off the computer. Applications belonging to that session close, and unsaved work may be lost if it is not saved first.

Log off is appropriate when ending work for one account on a shared computer or when another user needs to sign in. It is not a replacement for Restart or Shut Down: the computer remains running after logoff.

Lock

Lock secures the current Windows session while leaving applications and background work running. It is the appropriate choice when briefly leaving a workstation and expecting to continue soon.

Unlocking requires an authorized sign-in method, such as the account password, PIN, smart card, or another method permitted by the computer's security policy. Locking does not close applications or stop background activity.

Hibernate

Hibernate saves the current session state to storage and then powers down the computer. When Windows resumes successfully, open applications and much of the previous workspace can be restored.

Hibernate is useful for transporting a laptop or conserving battery while preserving a workspace. It appears in Process Explorer only when the hardware and firmware support it and Windows power configuration and organizational policy allow it.

Suspend or Sleep

Suspend, commonly called Sleep in Windows, places the computer in a low-power state while keeping the session available in memory. It normally resumes faster than hibernation.

Sleep generally depends on continued power to maintain the in-memory session. Hibernation writes the session to storage and powers off, so the saved state can survive loss of electrical power. Sleep may be unavailable when the hardware does not support it or when Windows or an organization has disabled it.

Choose the appropriate action

Leaving briefly: Choose Lock when you want to protect the desktop while applications continue running.
Ending only your session: Choose Log Off when the computer should stay on but your applications and session should close.
Applying updates or recovering from an issue: Choose Restart.
Preserving a workspace while powering down: Choose Hibernate, if available.
Taking a short break with quick resume: Choose Suspend/Sleep, if available.
Taking the computer out of service: Choose Shut Down after saving work and checking for other users or workloads.

Safety and operational considerations

Save documents and confirm that important applications have completed their work before ending a session, restarting, or powering off.
Check for running downloads, remote connections, services, virtual machines, databases, scheduled jobs, and shared-user activity.
On managed systems, confirm that the maintenance window and user-impact requirements permit the action.
Windows may delay the operation while applications request time to close or display unsaved-work prompts.
Review prompts and allow critical applications to close normally. Do not forcibly terminate important workloads merely to make the action occur faster.

For remote administration, verify which session and computer the command will affect before selecting it. A local-looking menu can still perform a disruptive system action on a managed or shared environment.

Why an action may be unavailable

Missing or blocked action	Likely cause	Where to verify	Recommended next step
Hibernate unavailable	Unsupported hardware or firmware, disabled Windows power state, or organizational policy.	Windows power settings and applicable device-management policy.	Enable it only through an approved configuration, or use Lock, Log Off, Restart, or Shut Down.
Suspend/Sleep unavailable	Unsupported sleep state, firmware limitation, disabled power setting, or policy restriction.	Windows power settings, supported sleep states, and organization policy.	Use an available alternative and ask an administrator if the feature is required.
Shutdown or Restart restricted	Insufficient permission, local security policy, or managed-device restrictions.	Windows security policy, device-management rules, or administrator guidance.	Use the permitted Windows workflow or contact the system administrator.
Action differs in a remote or managed environment	Remote-session limits, shared-use rules, or organization-controlled power policy.	Remote-session settings and organizational IT policy.	Confirm the target and obtain authorization before proceeding.

Unavailable actions should be handled through Windows power settings or organizational IT policy rather than forced through Process Explorer.

Troubleshoot delayed or unexpected actions

The selected action does not occur immediately

Windows may be waiting for applications to close, an application may be showing an unsaved-work prompt, or a background task or policy may be delaying the operation. Review visible prompts, save work, and allow applications to close normally.

Shutdown or Restart is denied

The account may lack the required permission, or the computer may be restricted because it is managed, shared, or accessed through a remote session. Use the permitted Windows workflow or contact the system administrator.

Log Off did not turn off the computer

That is expected behavior. Log Off affects only the current user session. Choose Shut Down to power off the computer or Restart to reboot it, after checking for other users and workloads.