VMware ESXi and vSphere Cluster Management

System Shutdown Actions in Process Explorer

Learn how to use Process Explorer's File > Shutdown controls to shut down, restart, lock, log off, hibernate, or suspend a Windows computer safely.

Process Explorer is a Windows utility for viewing and managing processes. It also provides system-session and power-management actions through its shutdown controls. These actions affect the current computer, not just one selected process.

This distinction matters: a process command can end or restart an individual application or service, while a system action can lock the desktop, end a user session, change the computer's power state, or reboot the operating system.

Open the Shutdown Menu

In Process Explorer, open the File menu and choose Shutdown. Depending on the version and system configuration, the available actions appear in a submenu or menu section.

The usual path is File > Shutdown. Select the action that matches your goal, then confirm that it is the intended action before applying it. Save documents and consider other users, services, remote connections, and running workloads before choosing a disruptive option.

What Each Action Does

Shut down

Shut down performs a complete operating-system power-off sequence. Windows closes the session and powers off the computer. Open applications may ask to close, and unsaved work or a nonresponsive application can delay or prevent completion.

After shutdown, the computer must be powered on again before it can be used. Shutdown is appropriate when the computer will not be used for an extended period or when a full power-off is required.

Restart

Restart shuts down Windows and then automatically boots the operating system again. Unlike shutdown, it leaves the computer ready to return to use without requiring someone to press the power button.

Restart is commonly used to complete software updates, apply configuration changes, recover from temporary problems, or reload system components. It still closes applications, so save work first.

Lock

Lock protects the active signed-in session without ending it. The desktop and applications remain running, but access is blocked until the appropriate user credentials are supplied.

Use lock when briefly leaving a workstation. Unlocking normally requires the user's password, PIN, smart card, or another credential configured for that computer.

Log off

Log off ends the current user's session. Applications in that session are closed, and unsaved work can be lost if it is not saved or if an application cannot complete its close prompt.

Logoff differs from lock because the session ends rather than remaining active. It also differs from restart and shutdown because the computer itself does not necessarily reboot or power off. Logoff is useful when handing a shared computer to another user.

Hibernate

Hibernate saves the current system memory state to persistent storage, such as a disk or solid-state drive, and then powers down the computer. When the computer is powered on again, Windows can generally restore the previous desktop session.

Hibernate uses less power than suspend because the computer is powered off, while preserving the open session. Availability depends on Windows power settings, supported hardware, storage, and organizational policy.

Suspend or sleep

Suspend, often called sleep in Windows, places the computer in a low-power state while preserving the active session. Resume is typically much faster than a cold boot because the session remains available in memory or another supported low-power arrangement.

Sleep usually consumes some power to preserve the session, whereas hibernation writes the session to persistent storage and powers down. Suspend may be unavailable or may not work if the hardware does not support the required state, Windows power settings disable it, or an organization restricts it.

Comparison of Process Explorer Shutdown Actions

Action — Current session — Power state — Typical use — Unsaved-work risk — Availability

Shut down — Ends — Computer powers off — Extended non-use or full power-off — High if work is not saved — Generally available, but applications, policy, or updates can delay it

Restart — Ends and starts a new session — Computer reboots — Updates, configuration changes, and troubleshooting — High if work is not saved — Generally available, but applications, policy, or updates can delay it

Lock — Retained and continues running — Normal powered-on state — Brief absence — Low direct risk, but running applications can still encounter their own problems — Usually available, subject to session and policy conditions

Log off — Ends — Computer remains powered on — Shared-computer handoff or ending a work session — High if work is not saved — Usually available, but applications or policy can delay it

Hibernate — Saved for restoration — Computer powers off — Preserve a session without ongoing normal power use — Save work before initiating — Requires supported hardware and enabled Windows power settings

Suspend — Retained — Low-power state — Short absence and quick return — Save important work before initiating — Requires supported and enabled sleep hardware and settings

Choosing the Correct Action

Start by deciding whether the session should remain active, whether the computer should stay powered on, and whether another person or service could be affected. Always save documents and notify affected users before disruptive actions.

Situation — Recommended action — Why — Preparation needed

Brief absence — Lock — Keeps applications and the session running while blocking unauthorized access — Lock the workstation; save especially important work

End of workday — Shut down, or hibernate if the open session must be preserved — Powers off the computer or preserves the session for later restoration — Save work and close applications when practical

System update — Restart — Reloads Windows and can complete changes that require a new boot — Save work and follow update prompts

Shared workstation handoff — Log off — Ends the current user's session so another user can sign in independently — Save work and close applications

Battery conservation — Hibernate, if available — Powers off while retaining the session on persistent storage — Save work and confirm that hibernation is supported

Troubleshooting restart — Restart — Reloads operating-system components and can clear temporary faults — Save work, notify affected users, and check for active workloads

Session, Power, and Workload Risks

A session is the desktop environment, applications, and user context active after sign-in. Lock preserves that session. Logoff ends it. Restart and shutdown also end the session, while hibernate and suspend are designed to preserve it for later restoration.

Do not treat a preserved session as a guarantee that every workload is safe. Unsaved documents, long-running jobs, remote connections, virtual machines, file transfers, and services can be interrupted or behave differently after resume or reboot. Verify critical work before any action other than locking.

Availability and Limitations

The shutdown menu is not identical on every computer. Hibernate and suspend entries appear or work only when supported by the computer and enabled by Windows power settings. Hardware firmware, drivers, power plans, battery conditions, and device capabilities can affect the available choices.

Organizational policy, permissions, remote-session conditions, active applications, pending updates, and management software can also limit an action or prevent it from completing. A menu entry should not be assumed to behave identically on every system.

Troubleshooting Shutdown Actions

Hibernate or suspend is missing or unavailable

  • Check the computer's configured Windows power options.
  • Confirm that the hardware and firmware support the desired sleep or hibernation state.
  • Check whether an organizational policy disables the action.
  • Ask a system administrator for help on a managed device.

Shutdown, restart, or logoff does not complete

  • Review open applications and save work.
  • Respond to prompts asking whether documents should be saved.
  • Allow applications and updates time to close or finish.
  • If a process is not responding, investigate it carefully before using more forceful measures, especially on a shared or production computer.

The wrong action was selected

  • Use Lock when the session should continue running while access is protected.
  • Use Log off when the current user session should end but the computer should remain on.
  • Use Restart when Windows must boot again, such as after an update or for troubleshooting.
  • Use Shut down when the computer should be fully powered off.

Exam-Relevant Notes

  • Shutdown is a complete operating-system power-off sequence.
  • Restart is shutdown followed by an automatic reboot.
  • Lock protects an active session without ending it.
  • Log off ends the current user's session and closes its applications.
  • Hibernate saves memory state to persistent storage and powers down.
  • Suspend retains the active session in a low-power state for quick resumption.
  • Process Explorer's system actions affect the computer or user session, not merely an individual process.
  • Hibernate and suspend depend on supported hardware, Windows power configuration, and policy.

For this feature, use Shutdown Actions as the reference topic when reviewing the available system and power controls.