shutdown

Enables you to shut down or restart local or remote computers, one at a time. Windows commands reference

On Windows, Linux, macOS 3 Sigma rules name it File shutdown.exe

Windows

from the Windows commands reference, CC BY 4.0

shutdown [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/fw] [/f] [/m \\computer][/t xxx][/d [p|u:]xx:yy [/c "comment"]]

To force apps to close and to restart the local computer after a one-minute delay, with the reason Application: Maintenance (Planned) and the comment "Reconfiguring myapp.exe", type

shutdown /r /t 60 /c "Reconfiguring myapp.exe" /f /d p:4:1Identify

/rRestarts the computer after shutdown. Windows commands reference

/tSets the time-out period before shutdown to *xxx* seconds. Windows commands reference

/cEnables you to create a custom reason for the system shutdown or restart, which must be enclosed in double quotation marks. Windows commands reference

/fForces running applications to close without warning users. Windows commands reference

/dLists the reason for the system restart or shutdown. Windows commands reference

Trips 1 Sigma rule: mediumSuspicious Execution of Shutdown by frack113

To perform a planned shutdown of a device in 10 minutes and capture the reason in the shutdown event tracker with the comment "Scheduled maintenance", type

shutdown.exe /s /t 600 /d p:0:0 /e /c "Scheduled maintenance"Identify

/sShuts down the computer. Windows commands reference

/tSets the time-out period before shutdown to *xxx* seconds. Windows commands reference

/dLists the reason for the system restart or shutdown. Windows commands reference

/eEnables you to document the reason for an unexpected shutdown of a computer in the Shutdown Event Tracker. Windows commands reference

/cEnables you to create a custom reason for the system shutdown or restart, which must be enclosed in double quotation marks. Windows commands reference

Trips 1 Sigma rule: mediumSuspicious Execution of Shutdown by frack113

To restart the remote computer myremoteserver with the same parameters as the previous example, type

shutdown /r /m \\myremoteserver /t 60 /c "Reconfiguring myapp.exe" /f /d p:4:1Identify

/rRestarts the computer after shutdown. Windows commands reference

/mSpecifies the target computer. Windows commands reference

/tSets the time-out period before shutdown to *xxx* seconds. Windows commands reference

/cEnables you to create a custom reason for the system shutdown or restart, which must be enclosed in double quotation marks. Windows commands reference

/fForces running applications to close without warning users. Windows commands reference

/dLists the reason for the system restart or shutdown. Windows commands reference

Trips 1 Sigma rule: mediumSuspicious Execution of Shutdown by frack113

To restart the remote computer myremoteserver in 5 minutes due to a security update and include a custom reason in the shutdown event tracker, type

shutdown /r /t 300 /e /c "Security Update" /m \\myremoteserverIdentify

/rRestarts the computer after shutdown. Windows commands reference

/tSets the time-out period before shutdown to *xxx* seconds. Windows commands reference

/eEnables you to document the reason for an unexpected shutdown of a computer in the Shutdown Event Tracker. Windows commands reference

/cEnables you to create a custom reason for the system shutdown or restart, which must be enclosed in double quotation marks. Windows commands reference

/mSpecifies the target computer. Windows commands reference

Trips 1 Sigma rule: mediumSuspicious Execution of Shutdown by frack113

To cancel a pending shutdown (must be run in a new command prompt window during the timeout period), type

shutdown /aIdentify

/aAborts a pending system shutdown. Windows commands reference

Show 23 options

/iDisplays the Remote Shutdown box. The /i option must be the first parameter following the command. If /i is specified, all other options are ignored.

/lSigns out the current user immediately with no time-out period. The /l parameter works independently and can't be combined with any other parameters. Attempts to combine /l with any other parameter is ignored.

/sShuts down the computer.

/sgShuts down the computer. On the next boot, if Automatic Restart Sign-On is enabled, the device automatically signs in and locks based on the last interactive user. After sign in, it restarts any registered applications.

/rRestarts the computer after shutdown.

/gFully shuts down and restarts the computer. On restart, if Automatic Restart Sign-On is enabled, the device automatically signs in and locks based on the last interactive user. After sign in, it restarts any registered applications.

/aAborts a pending system shutdown. This must be run as a separate command in a new command prompt window during the time-out period (for example, shutdown /a). Combine with /fw to clear any pending boots to firmware.

/pTurns off the local computer only (not a remote computer) with no time-out period or warning. You can use /p only with /d or /f. If your computer doesn't support power-off functionality, it shuts down when you use /p, but the power to the computer remains on.

/hPuts the local computer into hibernation, if hibernation is enabled. The /f switch can be used with the /h switch.

/hybridShuts down the device and prepares it for fast startup. This option must be used with the /s option.

/fwCombining this option with a shutdown option causes the next restart to go to the firmware user interface.

/eEnables you to document the reason for an unexpected shutdown of a computer in the Shutdown Event Tracker.

/oGoes to the Advanced boot options menu and restarts the device. This option must be used with the /r option.

/fForces running applications to close without warning users. Caution: Using the /f option might result in loss of unsaved data.

/m \<computername>Specifies the target computer.

/t <xxx>Sets the time-out period before shutdown to xxx seconds. The valid range is 0-315360000 (10 years), with a default of 30. If the timeout period is greater than 0, the /f parameter is implied.

/d [p | u:]<xx>:<yy>Lists the reason for the system restart or shutdown. The supported parameter values are: - P - Indicates that the restart or shutdown is planned. - U - Indicates that the reason is user-defined. If p or u aren't specified, the restart or shutdown is unplanned. - xx - Specifies the major reason number (a positive integer, less than 256). - yy Specifies the minor reason number (a positive integer, less than 65536).

/c <comment>Enables you to create a custom reason for the system shutdown or restart, which must be enclosed in double quotation marks. You can use a maximum of 512 characters. Can also be used with the /d parameter.

/?Displays help at the command prompt, including a list of the major and minor reasons that are defined on your local computer.

U0 0 Other (Unplanned)

E0 0 Other (Unplanned)

E or P0 0 Other (Planned)

P2 3 Operating System: Upgrade (Planned)

Linux

from tldr-pages, CC BY 4.0

Shut down and reboot the system.

Power off (halt) immediately

shutdown -h nowIdentify