https://old.reddit.com/r/sysadmin/comments/vqcf67/windows_undocumented_emergency_restart/ jump to content my subreddits edit subscriptions * popular * -all * -random * -users | * AskReddit * -news * -pics * -funny * -worldnews * -gaming * -movies * -tifu * -aww * -videos * -explainlikeimfive * -mildlyinteresting * -todayilearned * -dataisbeautiful * -TwoXChromosomes * -science * -LifeProTips * -Showerthoughts * -space * -Jokes * -nottheonion * -books * -IAmA * -OldSchoolCool * -askscience * -Documentaries * -gifs * -sports * -UpliftingNews * -Art * -Music * -Futurology * -food * -nosleep * -DIY * -history * -photoshopbattles * -gadgets * -InternetIsBeautiful * -EarthPorn * -philosophy * -GetMotivated * -WritingPrompts * -creepy * -announcements * -listentothis * -blog more >> sysadmin sysadmin * comments * other discussions (1) Want to join? Log in or sign up in seconds.| * English [ ][] [ ]limit my search to r/sysadmin use the following search parameters to narrow your results: subreddit:subreddit find submissions in "subreddit" author:username find submissions by "username" site:example.com find submissions from "example.com" url:text search for "text" in url selftext:text search for "text" in self post contents self:yes (or self:no) include (or exclude) self posts nsfw:yes (or nsfw:no) include (or exclude) results marked as NSFW e.g. subreddit:aww site:imgur.com dog see the search faq for details. advanced search: by author, subreddit... this post was submitted on 03 Jul 2022 1,472 points (98% upvoted) shortlink: [https://redd.it/vqcf] [ ][ ] [ ]remember mereset password login Submit a new text post Get an ad-free experience with special benefits, and directly support Reddit. get reddit premium sysadmin joinleave711,341 readers 2,727 users here now A reddit dedicated to the profession of Computer System Administration --------------------------------------------------------------------- Rules 1. Community members shall conduct themselves with professionalism. 2. Do not expressly advertise your product. More details on the rules may be found in the wiki. --------------------------------------------------------------------- For IT career related questions, please visit /r/ITCareerQuestions --------------------------------------------------------------------- Please check out our Frequently Asked Questions, which includes lists of subreddits, webpages, books, and other articles of interest that every sysadmin should read! Checkout the Wiki Users are encouraged to contribute to and grow our Wiki. So you want to be a sysadmin? RTFM --------------------------------------------------------------------- Sysadmin Jobs Official IRC Channel - #reddit-sysadmin on irc.libera.chat Official Discord - https://discord.gg/sysadmin --------------------------------------------------------------------- * Link Flair Filters * Gilded Comments a community for 13 years MODERATORS * message the mods * Moderator list hidden. Learn More discussions in r/sysadmin <> X 706 * 352 comments How to convince management that something like Git is industry standard? 217 * 551 comments what are the best philosophies to live by in tech? 32 * 55 comments is low 70s a good salary for a system administrator? * 24 comments RANT: I hate the phrase "Please Do the Needful" 75 * 65 comments Losing my mind. 631 * 157 comments Previous company has been bashing my name since I left 69 * 64 comments Workaround culture 19 * 50 comments We acquired a company division that was spun off. We need to acquire their data. It's in Lotus Notes and is comingled with their parent corp. Can we discuss viable migration options? * 11 comments Anyone else seeing Network Solutions DNS timeouts 7 * 6 comments We are an organization that only supports Windows based clients... Now we are being asked what it would take to add Apple products.. What would you request to help manage them enterprise wide.. Welcome to Reddit, the front page of the internet. Become a Redditor and join one of thousands of communities. x 1471 1472 1473 QuestionWindows' undocumented "Emergency restart". (self.sysadmin) submitted 2 days ago by -Steets-[5izbv4fn0m]2[silver_48]4[klvxk1wggf] Howdy, folks! Happy Fourth of July weekend. This is a weird one -- did you know that Windows has an "emergency restart" button? I certainly didn't until a few hours ago. As far as I can tell, it's completely undocumented, but if you press CTRL+ALT+DEL, then Ctrl-click the power button in the bottom right, you'll be greeted by a prompt that says the following: Emergency restart Click OK to immediately restart. Any unsaved data will be lost. Use this only as a last resort. [ OK ] [ CANCEL ] Now, I wouldn't consider this to be remarkable -- Ctrl+Alt+Del is the "panic screen" for most people, after all, it makes sense to have something like this there -- but what baffles me is just how quickly it works. This is, by far, the fastest way to shut down a Windows computer other than pulling the power cord. There is no splash text that says "Restarting...", no waiting, nothing. As soon as you hit "OK", the loading spinner runs for a brief moment, and the system is completely powered off within three seconds. I encourage you to try it on your own machine or in a VM (with anything important closed, of course). I wanted to share this with the people in this subreddit because A) this is a neat debugging/diagnostic function to know for those rare instances where Task Manager freezes, and B) I'm very curious as to how it works. I checked the Windows Event Log and at least to the operating system, the shutdown registers as "unexpected" (dirty) which leads me to believe this is some sort of internal kill-the-kernel-NOW functionality. After a bit of testing with Restart-Computer and shutdown /r /f, I've found that no officially-documented shutdown command or function comes close in speed -- they both take a fair bit of time to work, and importantly, they both register in the Event Log as a clean shutdown. So what's going on here? I'm interested in trying to figure out what command or operation the system is running behind the scenes to make this reboot happen so rapidly; as far as I can tell, the only way to invoke it is through the obscure UI. I can think of a few use cases where being able to use this function from the command line would be helpful, even if it causes data loss, as a last resort. Thanks for the read, hope you enjoy your long weekend! * 217 comments * share * save * hide * report top 200 commentsshow all 217 sorted by: best topnewcontroversialoldrandomq&alive (beta) [ ] Want to add to the discussion? Post a comment! Create an account [-]ghjm 606 points607 points608 points 2 days ago[klvxk1wggf]2 [Illuminati] (37 children) See https://www.codeproject.com/Articles/34194/ Performing-emergency-shutdowns for how to do this from code. tl;dr - You have to import ntdll.dll (the kernel API) and call the undocumented function NtSetSystemPowerState. * permalink * embed * save * report * give award * reply [-]mandrack3 254 points255 points256 points 2 days ago (9 children) This is a power no mere mortals should have :) great find! * permalink * embed * save * parent * report * give award * reply [-]SteveJEO 127 points128 points129 points 2 days ago (2 children) NTDLL function list. https://geoffchappell.com/studies/windows/win32/ntdll/api/native.htm? tx=50 * permalink * embed * save * parent * report * give award * reply [-]IdlePro 3 points4 points5 points 1 day ago (1 child) Geoff rocks! * permalink * embed * save * parent * report * give award * reply [-]SteveJEO 4 points5 points6 points 1 day ago (0 children) I was just thinking that having to post this stuff is the stupidest shit in the world. We should all have this lying around somewhere anyway. Hey! u/MSModerator Are you still alive? You dead? Where's the latest incarnation of the ntdll reference doc? * permalink * embed * save * parent * report * give award * reply [-]billy_teats 86 points87 points88 points 2 days ago (0 children) Lol which is why Microsoft specifically did not tell people. * permalink * embed * save * parent * report * give award * reply [-]QuantumLeapChicago 32 points33 points34 points 2 days ago (4 children) I use to have a 2-volume Win32 reference. (Yes, books, that's how knowledge used to be shared before the digital age). The kernel itself was wild, but i remember using it to find keyboard hooks so i could create a Defender-bypassing keylogger. (This was about 10 years ago and just for curiosity). Last time I dug around, WinRT was the new thing, but I was having a much harder time using much narrower scoped calls to get anything done natively. So i switched to Qt / react / Linux / or the occasional compiled tool and left windows behind. * permalink * embed * save * parent * report * give award * reply [-]orwiad10 15 points16 points17 points 2 days ago (3 children) And knowledge is still shared that way... * permalink * embed * save * parent * report * give award * reply [-]DenizenEvil 14 points15 points16 points 2 days ago (2 children) Didn't you hear? Books don't exist anymore. The best we have are the fossilized remains of ancient texts. * permalink * embed * save * parent * report * give award * reply continue this thread [-]-Steets-[S] 67 points68 points69 points 2 days ago* (3 children) Oh, awesome! This is exactly what I was looking for, it checks all the boxes! Random executable, obscure instruction/function, functionality hearkening back at least 20ish yeah because Windows... Who are you who is so wise in the ways of science? This is super cool, thanks a ton! * permalink * embed * save * parent * report * give award * reply [-]tuple09 8 points9 points10 points 1 day ago (2 children) A duck! * permalink * embed * save * parent * report * give award * reply [-]Elvith 2 points3 points4 points 1 day ago (0 children) Probably a rubber duck, that payed attention while assisting in debugging * permalink * embed * save * parent * report * give award * reply [-]tmikes83Jack of All Trades 1 point2 points3 points 9 hours ago (0 children) If she... weighs the same... as a duck.... .... ... she's made of wood!!! * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 125 points126 points127 points 2 days ago[klvxk1wggf] (17 children) ntdll.dll contains the list of syscall functions by name. NT only lets userland know the names of the NT-level functions, not their Kernel ABI (syscall numbers) like Unix/Linux do, so everything has to vector through ntdll.dll with C ABI. Microsoft heavily discouraged anyone from looking under the covers, but this is why Mark Russinovich runs a division at Microsoft and you don't. For the curious, the list of syscall names is in section 2 of the Unix/Linux man pages, and the list of 64-bit KABI syscall numbers in Linux is in /usr/include/asm/unistd_64.h. * permalink * embed * save * parent * report * give award * reply [-]ghjm 11 points12 points13 points 2 days ago (1 child) The reason you have to go through ntdll.dll is that Microsoft doesn't keep the syscall ABI consistent from one version of Windows to the next. See https://j00ru.vexillium.org/syscalls/nt/64/. You can make direct syscalls on Windows if you want, but nobody ever does because it would mean having to keep your own table of per-version syscall conventions - essentially, you'd have to rewrite ntdll.dll. * permalink * embed * save * parent * report * give award * reply [-]bendhoe 0 points1 point2 points 5 hours ago (0 children) Actually some video game anticheat software does use direct syscalls to avoid the possibility of cheaters replacing DLL functions with dummy versions. That makes life difficult for projects like WINE which rely on windows programs doing everything through DLLs. * permalink * embed * save * parent * report * give award * reply [-]aprimeproblem 11 points12 points13 points 2 days ago (6 children) Dave? Is that you? * permalink * embed * save * parent * report * give award * reply [-]orwiad10 11 points12 points13 points 2 days ago (2 children) Pretty sure plummer has a known handle on reddit. * permalink * embed * save * parent * report * give award * reply [-]negative_xer0 16 points17 points18 points 2 days ago (0 children) He does, it's u/daveplreddit. He commented about 30m ago and - as always - was very insigbful and shared a cool anecdote. * permalink * embed * save * parent * report * give award * reply [-]aprimeproblem 6 points7 points8 points 2 days ago (0 children) I'm amazed that people know who I'm referring to, he's such a great guy! * permalink * embed * save * parent * report * give award * reply [-]caillouistheworst 8 points9 points10 points 1 day ago (2 children) Dave's not here, man. * permalink * embed * save * parent * report * give award * reply [-]daveplreddit 4 points5 points6 points 1 day ago (1 child) Dave's here, man! * permalink * embed * save * parent * report * give award * reply continue this thread [-]Macho_Chad 27 points28 points29 points 2 days ago (7 children) You seem really smart. * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 50 points51 points52 points 2 days ago (6 children) Thanks, Chad. It was a peripheral observation, but I bet it will help the occasional reader who finds it with a search engine -- like the original post. I don't have much occasion to touch Windows, and it's usually legacy systems when I do, but I've always found the history and internals of NT itself to be interesting. There aren't that many people around who know it well, and of those who do, very few in an operational capacity. I'd hate to have to hire real experts, because they're so rare, compared to operators. * permalink * embed * save * parent * report * give award * reply [-]Macho_Chad 24 points25 points26 points 2 days ago (1 child) I'm my companies expert! But nowhere near your level. It's inspiring. Gonna keep hitting the books * permalink * embed * save * parent * report * give award * reply continue this thread [-]Adobe_Flesh 8 points9 points10 points 2 days ago (3 children) Does the history go that Russinovich reverse engineered things himself? And then Microsoft hired him? * permalink * embed * save * parent * report * give award * reply continue this thread [-]Thotaz 2 points3 points4 points 1 day ago (0 children) If you want to do this in PowerShell you can use this C# type definition: Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; namespace Win32Api { public enum PowerAction : ulong { PowerActionNone = 0, PowerActionReserved = 1, PowerActionSleep = 2, PowerActionHibernate = 3, PowerActionShutdown = 4, PowerActionShutdownReset = 5, PowerActionShutdownOff = 6, PowerActionWarmEject = 7, PowerActionDisplayOff = 8 } public enum PowerSystem : ulong { PowerSystemUnspecified = 0, PowerSystemWorking = 1, PowerSystemSleeping1 = 2, PowerSystemSleeping2 = 3, PowerSystemSleeping3 = 4, PowerSystemHibernate = 5, PowerSystemShutdown = 6, PowerSystemMaximum = 7 } public enum WindowsPrivileges : ulong { SeCreateTokenPrivilege = 1, SeAssignPrimaryTokenPrivilege = 2, SeLockMemoryPrivilege = 3, SeIncreaseQuotaPrivilege = 4, SeUnsolicitedInputPrivilege = 5, SeMachineAccountPrivilege = 6, SeTcbPrivilege = 7, SeSecurityPrivilege = 8, SeTakeOwnershipPrivilege = 9, SeLoadDriverPrivilege = 10, SeSystemProfilePrivilege = 11, SeSystemtimePrivilege = 12, SeProfileSingleProcessPrivilege = 13, SeIncreaseBasePriorityPrivilege = 14, SeCreatePagefilePrivilege = 15, SeCreatePermanentPrivilege = 16, SeBackupPrivilege = 17, SeRestorePrivilege = 18, SeShutdownPrivilege = 19, SeDebugPrivilege = 20, SeAuditPrivilege = 21, SeSystemEnvironmentPrivilege = 22, SeChangeNotifyPrivilege = 23, SeRemoteShutdownPrivilege = 24, SeUndockPrivilege = 25, SeSyncAgentPrivilege = 26, SeEnableDelegationPrivilege = 27, SeManageVolumePrivilege = 28, SeImpersonatePrivilege = 29, SeCreateGlobalPrivilege = 30, SeTrustedCredManAccessPrivilege = 31, SeRelabelPrivilege = 32, SeIncreaseWorkingSetPrivilege = 33, SeTimeZonePrivilege = 34, SeCreateSymbolicLinkPrivilege = 35 } public class NtDll { [DllImport("ntdll.dll", EntryPoint="RtlAdjustPrivilege")] public static extern int RtlAdjustPrivilege(WindowsPrivileges Privilege, bool Enable, bool CurrentThread, ref bool Enabled); [DllImport("ntdll.dll", EntryPoint="NtSetSystemPowerState")] public static extern int NtSetSystemPowerState(PowerAction action, PowerSystem system, ulong reason); } } "@ And call it like this: [Win32Api.NtDll]::RtlAdjustPrivilege( [Win32Api.WindowsPrivileges]::SeShutdownPrivilege, $true, $false, [ref] $null ) [Win32Api.NtDll]::NtSetSystemPowerState( [Win32Api.PowerAction]::PowerActionShutdownReset, [Win32Api.PowerSystem]::PowerSystemShutdown, 0 ) Since most of the code is simply C# this should work all the way back to PowerShell 2.0 (Where Add-Type was added AFAIK). * permalink * embed * save * parent * report * give award * reply [-]dextersgenius 1 point2 points3 points 1 day ago (3 children) Personally I prefer this project (Pull the Plug) - the code is readable directly on Github and doesn't require signing up. :) * permalink * embed * save * parent * report * give award * reply [-]DerivativeOfLog7 1 point2 points3 points 3 hours ago (1 child) Hi! I noticed my repo was getting a few stars, so I looked it up and found your comment. I'm very glad you like it, I personally think this obscure Windows "feature" could be very useful if only people knew about it! * permalink * embed * save * parent * report * give award * reply [-]dextersgenius [score hidden] 5 minutes ago (0 children) Thank you for making it, as a sysadmin this is pretty handy! Brought it up in our team meeting yesterday and everyone were pleasantly surprised that this exists - it's now part of our toolbox, and we can't wait to try it out it the next time we come across an unresponsive box! * permalink * embed * save * parent * report * give award * reply [-]ghjm 0 points1 point2 points 1 day ago (0 children) Nice. There's a lot of old win32 knowledge tied up in old sites like that. Nice to see some of it being carried forward a bit. Someday, GitHub will be an almost-forgotten site where only old people go, to look up memories from back in the days of web dev and open source. * permalink * embed * save * parent * report * give award * reply [-]Jay_JWLH 239 points240 points241 points 2 days ago (21 children) If it got logged as a dirty shutdown, maybe it pulled its own plug virtually. * permalink * embed * save * report * give award * reply [-]-Steets-[S] 159 points160 points161 points 2 days ago* (17 children) I'm leaning towards this being the answer. Maybe it sends the ACPI restart signal while it's still running? That would at least explain why there are no exposed APIs or commands for it anywhere. Still, I wonder if there's a way to trigger it manually by calling rundll.exe or something. Edit: in a comment above by ghjm, they explain that this is literally exactly what happens -- the NT kernel calls the power off operation immediately instead of flushing the caches and writing things to disk. Neat! * permalink * embed * save * parent * report * give award * reply [-]JimTheJerseyGuy 42 points43 points44 points 2 days ago (16 children) Pretty sure that's exactly what happens. * permalink * embed * save * parent * report * give award * reply [+]Amaurosys comment score below threshold-20 points-19 points-18 points 2 days ago* (15 children) Might simply be shutdown -r -f -t 0 Edit: I mean I think the shutdown binary may be calling the same api function in the same way with this specific set of parameters. -t implies -f for all values other than 0, hence the inclusion of the parameter in my original comment. * permalink * embed * save * parent * report * give award * reply [-]BrightBeaver 9 points10 points11 points 2 days ago (1 child) Is that equivalent to 'shutdown -r now'? Because that still takes a while. * permalink * embed * save * parent * report * give award * reply continue this thread [-]Entegy 5 points6 points7 points 2 days ago (12 children) Not sure why you're being downvoted, putting a time of 0 can absolutely be registered as a dirty shutdown and affect applications in weird ways. Doing /t 1 is infinitely better and has never registred as a dirty shutdown. * permalink * embed * save * parent * report * give award * reply continue this thread [-]cannons_for_days 47 points48 points49 points 2 days ago (0 children) It's slightly more complicated than that, but that's the idea. Basically, it's skipping all of the stuff it needs to do for a graceful shutdown like safely dismounting drives and such. The actual "shut it off" command is quite simple and takes very little time. It's all the stuff that makes "shut it off" nondestructive that can take a bit. Obviously you should never do this as anything but a last resort. It's not just logged as a dirty shutdown - it is a dirty shutdown. * permalink * embed * save * parent * report * give award * reply [+]Jay_JWLH comment score below threshold-20 points-19 points-18 points 2 days ago (1 child) Now that I think about it, I bet they need this because some servers are made to be so hard to turn off (multiple PSUs and UPS backup), that you just gotta. * permalink * embed * save * parent * report * give award * reply [-]asdlkfSithadmin 42 points43 points44 points 2 days ago (0 children) Those types of servers will have baseboard management controllers such as IPMI, iLo, iDRAC or similar which literally runs a wev server with a "click here to power cycle the server" button. Some BMCs even have watchdog capabilities which can probe at the server and respond; for example, "try to ping the OS of the server. If it doesn't respond for 2 minutes, hard reset the server. " * permalink * embed * save * parent * report * give award * reply [-]Losus 49 points50 points51 points 2 days ago (1 child) I believe Windows Server has something similar with the restart command available in the Special Administrative Console, a console available over serial when you've enabled EMS in the boot settings. I've used it before with Windows Server systems no longer responding to other local or remote administrative actions, and it too appears to cause an almost immediate reboot bypassing most clean shutdown processes. No idea if this or your emergency reboot method attempt to at least flush all write buffers to disk before rebooting. * permalink * embed * save * report * give award * reply [-]chandleyaIT Manager 0 points1 point2 points 1 day ago (0 children) Readily available and used in Azure. * permalink * embed * save * parent * report * give award * reply [-]theevilsharpieJack of All Trades 93 points94 points95 points 2 days ago* (18 children) I'm interested in trying to figure out what command or operation the system is running behind the scenes to make this reboot happen so rapidly; as far as I can tell, the only way to invoke it is through the obscure UI. I can think of a few use cases where being able to use this function from the command line would be helpful, even if it causes data loss, as a last resort. The process to gracefully shut down a machine is usually handled by the process manager (e.g., systemd on Linux), which contains the needed logic to close open programs and services, log out any users, and otherwise gracefully stop running processes. Once all that's done, the process manager will execute a system call that instructs the kernel to reboot the machine. However, you can just execute the system call to reboot the machine yourself, and skip all of that "graceful shutdown" nonsense. On Linux, you can do so with the following C program: #include #include #include int main(int argc, char *argv[]) { syscall(SYS_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2, LINUX_REBOOT_CMD_RESTART); } (This should go without saying, but don't execute this program on a machine you care about. This command doesn't sync in-flight data to disk before rebooting, so it's similar to pressing the computer's physical "reset" button.) As for what that's running behind the scenes, see https://github.com/ torvalds/linux/blob/v5.18/kernel/reboot.c#L304-L398 What the kernel is running behind the scenes depends on the platform (and for x86, whether the machine is using BIOS or UEFI), but ultimately, the platform will tell the CPU to jump to its reset vector, which is an area of memory that contains the instructions needed to boot the machine. * permalink * embed * save * report * give award * reply [-]SimonKepp 27 points28 points29 points 2 days ago (5 children) This command doesn't sync in-flight data to disk before rebooting This was what I first thought about, when reading the original post. This comes with significant risk of leaving your file system or individual files in an inconsistent state, so should definitely only be used as a "last resort". * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 27 points28 points29 points 2 days ago (4 children) Modern filesystems all journal. NTFS was originally ahead of most Unix flavors on that count, though today it's far behind everyone else. Systems have been basically "crash-safe" for twenty years. There's a principle of design, "crash first", where you code systems for the primary means of termination to be an ungraceful crash -- then everything else is gravy. As for files, app code is supposed to be calling fsync(2) to flush buffers. Hardware is supposed not to be lying about the result (e.g., no passing it to battery-backed cache and then lying to the kernel). * permalink * embed * save * parent * report * give award * reply [-]SimonKepp 19 points20 points21 points 2 days ago (0 children) supposed to Yes, but this does not always happen in reality. * permalink * embed * save * parent * report * give award * reply [-]TrueStoriesIpromise 1 point2 points3 points 1 day ago (2 children) Yeah, one of my team members did a hard restart from the vmware console of a windows server a month ago and completely borked the server; I had to upgrade it to get all the files back, and even now it's missing chunks of registry (application-side, not system side, obviously the upgrade took care of that). * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 1 point2 points3 points 1 day ago (1 child) Interesting. It's been a long time since I used vSphere, but you can soft-shutdown from inside it with ACPI, as I recall, can you not? In QEMU you can, and it does indeed soft-shutdown Windows Server. * permalink * embed * save * parent * report * give award * reply continue this thread [-]bLaR46fifr8Jhyg978d8 14 points15 points16 points 2 days ago (0 children) Or you can use the SysRq commands to initiate immediate reboot/ shutdown https://en.wikipedia.org/wiki/Magic_SysRq_key * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 14 points15 points16 points 2 days ago (0 children) Real hackers kexec_load() a new kernel and then crash to it, without going through boring system firmware and letting it pick a bootloader and all of that goings on. * permalink * embed * save * parent * report * give award * reply [-]DocToska 4 points5 points6 points 2 days ago* (2 children) Here are two really simple ways to force a clean and a non-clean reboot on Linux: Unclean Reboot: echo 1 > /proc/sys/kernel/sysrqecho b > /proc/sysrq-trigger Forced shutdown (unclean): echo 1 > /proc/sys/kernel/sysrqecho o > /proc/sysrq-trigger * permalink * embed * save * parent * report * give award * reply [-]DarthPneumonoSecurity Admin but with more hats 7 points8 points9 points 2 days ago* (0 children) You usually don't have to do the first echo (at least on modern Fedora, Ubuntu, and Debian it's already enabled) Also worth noting that 'b' is not a clean reboot, it doesn't sync disks or do anything else, it just immediately reboots. edit for clarity: The only difference between the above is whether the system powers off or reboots after. * permalink * embed * save * parent * report * give award * reply [-]vman81 3 points4 points5 points 2 days ago (0 children) Sysrq+REISUB to do it more cleanly, including syncing disks, terminating/killing processes, remounting in RO mode and force rebooting. * permalink * embed * save * parent * report * give award * reply [+]Superb_Raccoon comment score below threshold-11 points-10 points-9 points 2 days ago (4 children) Or just run "halt" * permalink * embed * save * parent * report * give award * reply [-]theevilsharpieJack of All Trades 16 points17 points18 points 2 days ago (3 children) "halt" stops further machine execution (rather than rebooting), and does so while stopping running processes gracefully, so it's not an equivalent at all. * permalink * embed * save * parent * report * give award * reply [-]erific -4 points-3 points-2 points 2 days ago (1 child) reboot -f * permalink * embed * save * parent * report * give award * reply [-]Superb_Raccoon 0 points1 point2 points 2 days ago (0 children) Don't know why you are getting downvoted for a correct answer on LINuX * permalink * embed * save * parent * report * give award * reply [-]Superb_Raccoon -2 points-1 points0 points 2 days ago (0 children) Depends on the implementation. https://www.ibm.com/docs/en/aix/7.2?topic=h-halt-fasthalt-command The halt command writes data to the disk and then stops the processor.The halt command writes data to the disk and then stops the processor. Solaris The halt and poweroff utilities write any pending information to the disks and then stop the processor. The poweroff utility has the machine remove power, if possible. Linux should do it the same way, but may be hardware dependent. Not all systems have a proper firmware hypervisor * permalink * embed * save * parent * report * give award * reply [-]bagpussnz9 0 points1 point2 points 2 days ago (0 children) I guess if you are in a position to be able to run this program then things arent as bad as they seem... and you could potentially run a few syncs and a sys magic. * permalink * embed * save * parent * report * give award * reply [-]Googol20 78 points79 points80 points 2 days ago (4 children) That has been around for years, works in windows 8 and 7 too. * permalink * embed * save * report * give award * reply [-]-Steets-[S] 60 points61 points62 points 2 days ago (3 children) I saw mention of it definitely working in Windows 8, but I wasn't sure about it going as far back as 7. Crazy that the only place it's ever mentioned is in weird MSDN posts and personal websites. * permalink * embed * save * parent * report * give award * reply [-]Googol20 23 points24 points25 points 2 days ago (1 child) https://www.google.com/search?q=windows+emergency+restart+microsoft& sxsrf=ALiCzsbRlU_ufoWn-abcPiB2B6wvGW5qaQ%3A1656837072281&ei= 0FPBYr7rEMrAkPIP0cia2AM&oq=windows+emergency+restart%2C+micr&gs_lcp= ChNtb2JpbGUtZ3dzLXdpei1zZXJwEAEYADIFCCEQoAEyBQghEKABMgUIIRCgATIFCCEQoAEyBQghEKABMggIIRAeEBYQHTIICCEQHhAWEB0yCAghEB4QFhAdOgcIABBHELADOgYIABAeEBY6BQghEKsCOgcIIRAKEKABSgQIQRgAUMAJWIEUYOweaAFwAXgAgAGIAYgBqAWSAQMxLjWYAQCgAQHIAQjAAQE &sclient=mobile-gws-wiz-serp#ip=1 Lot of websites cover it but have to know to search the terms probably * permalink * embed * save * parent * report * give award * reply [-]-Steets-[S] 23 points24 points25 points 2 days ago (0 children) That's actually how I found it initially, through a weird third-party website. Kind of strange that there's no official documentation on it, though. * permalink * embed * save * parent * report * give award * reply [-]thesaddestpanda 8 points9 points10 points 2 days ago* (0 children) Because of it had a higher visibility "gamer culture" and awful help desk agents would know about it and advise everyone to do it for "faster reboots" and not caring if it corrupts someones system. * permalink * embed * save * parent * report * give award * reply [-]Ciderhero 70 points71 points72 points 2 days ago (30 children) You mean you don't park the heads?! Are you crazy? * permalink * embed * save * report * give award * reply [-]RunningAtTheMouth 26 points27 points28 points 2 days ago (2 children) I 'member parking the heads back in the day. Then we got disks that would handle that cleanly and life could not get any better. * permalink * embed * save * parent * report * give award * reply [-]bwyer 10 points11 points12 points 2 days ago (0 children) DISKPARK.EXE * permalink * embed * save * parent * report * give award * reply [-]riemsesy 9 points10 points11 points 2 days ago (0 children) I was still in school, but when I finished school park was automated * permalink * embed * save * parent * report * give award * reply [-]Rocky_Mountain_Way 29 points30 points31 points 2 days ago (20 children) remember to give the "sync" command three times too if you're running Unix on your PDP-11 * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 16 points17 points18 points 2 days ago (3 children) No matter what, do not tease your sempai for manually running sync; sync;sync. I think I finally stopped a few years ago. Or at least I haven't caught myself doing it recently. * permalink * embed * save * parent * report * give award * reply [-]BridgeBum 6 points7 points8 points 2 days ago (2 children) What I was taught was that you should type each sync separately and not try to combine them. Part of the idea behind the typing was to give enough time for the system to fully execute parking the heads. Running it in batches like this is too fast. Could be one of those myths, easily. * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 2 points3 points4 points 2 days ago (1 child) sync definitely doesn't return until buffers are flushed. Try it, by waiting until you system is under heavy writes, then run it. * permalink * embed * save * parent * report * give award * reply continue this thread [-]JohnGypsyJack of All Trades 11 points12 points13 points 2 days ago (5 children) I'm running modern Linux and still always sync at least twice before shutdown or restart. :) * permalink * embed * save * parent * report * give award * reply [-]Rocky_Mountain_Way 19 points20 points21 points 2 days ago (4 children) I have a bunch of PDP-11 and VAX in my basement. ...and occasionally, if I'm feeling particularly crazy, I'll just do one sync before I hit the "halt" switch. I also run with scissors too. I live life on the edge. * permalink * embed * save * parent * report * give award * reply [-]VexingRaven 4 points5 points6 points 2 days ago (2 children) "A bunch"? Is your basement a warehouse?! * permalink * embed * save * parent * report * give award * reply continue this thread [-]JohnGypsyJack of All Trades 4 points5 points6 points 2 days ago (0 children) Madlad! :) * permalink * embed * save * parent * report * give award * reply [-]Teknikal_DomainToo many VMs for one man 1 point2 points3 points 2 days ago (3 children) Okay, why three? * permalink * embed * save * parent * report * give award * reply [-]Rocky_Mountain_Way 8 points9 points10 points 2 days ago* (2 children) The sync command flushes all buffers and pending writes in RAM out to the disk. But the sync command returns back to the CLI prompt asynchronously and just begins the operating system sync. But back when computers and disks were slow, three syncs typed in succession gave enough time for the OS to complete the buffer flush and physical write to disk. Now, it's just tradition. * permalink * embed * save * parent * report * give award * reply [-]Teknikal_DomainToo many VMs for one man 2 points3 points4 points 2 days ago (1 child) I know what sync is, it seems that being asynchronous defeats the point of the command in the first place though. * permalink * embed * save * parent * report * give award * reply continue this thread [-]pinacoelho -1 points0 points1 point 2 days ago (5 children) You only need it twice: the sync call is asynchronous unless another sync is running. The first sync calls the kernel sync, which returns immediately (async), the second sync calls the kernel sync, which is held because the first sync is still running inside the kernel. * permalink * embed * save * parent * report * give award * reply [-]Rocky_Mountain_Way 3 points4 points5 points 2 days ago* (4 children) You only need it twice That's nice. I'm going to continue to do it three times on my PDP-11 and VAX. Perhaps YOU have fast memory and disk. But I don't. one of my disks has an average access time of 67 MILLIseconds. Tradition. I'm old. Get off my lawn you whippersnapper! * permalink * embed * save * parent * report * give award * reply [-]pinacoelho 0 points1 point2 points 2 days ago (3 children) It's not about how fast the disk is, it's about the second call blocking inside the kernel until the first one finishes. GetOffMyLawn? Because I knew the difference between folklore and how it works in the background? * permalink * embed * save * parent * report * give award * reply continue this thread [-]lemachet 8 points9 points10 points 2 days ago (0 children) Park.com * permalink * embed * save * parent * report * give award * reply [-]4kVHS 4 points5 points6 points 2 days ago (2 children) Laughs in SSD's * permalink * embed * save * parent * report * give award * reply [-]Mr_ToDo 2 points3 points4 points 1 day ago (1 child) Oh, how much do you trust that your SSD has enough power to flush your cache to the drive and not just drop data when power is pulled? It's no scratched platter, but at least with that you knew you were screwed and didn't find out much later. * permalink * embed * save * parent * report * give award * reply [-]4kVHS 1 point2 points3 points 23 hours ago (0 children) My company trusts enterprise grade SSDs. Aside from our SAN's I'm pretty sure all our servers are pure SSDs these days. * permalink * embed * save * parent * report * give award * reply [-]cptskippy 0 points1 point2 points 5 hours ago (0 children) Quit tweaking my PTSD. * permalink * embed * save * parent * report * give award * reply [-]DonHopkins 0 points1 point2 points 3 hours ago (0 children) The HP2000 would crash when you tried to rewind a disk drive. * permalink * embed * save * parent * report * give award * reply [-]f33dit 60 points61 points62 points 2 days ago (8 children) Maybe ask Dave about it. He has some deep insights into the Windows Kernel and wrote the Task Manager. * permalink * embed * save * report * give award * reply [-]Orcwin 15 points16 points17 points 2 days ago (4 children) Pretty sure I've seen him around on Reddit, too. * permalink * embed * save * parent * report * give award * reply [-]f33dit 29 points30 points31 points 2 days ago (3 children) Indeed. u/daveplreddit did an AMA a while ago. * permalink * embed * save * parent * report * give award * reply [-]daveplreddit 38 points39 points40 points 2 days ago (2 children) Indeed... I'm ironically on a Macbook rightnow so can't test it, but as I recall, if you hold down CTRL (or maybe some other modified) and pick the Shutdown menu, it will do NtShutdownSystem(SHUTDOWN_AND_POWEROFF); That was *my* fast exit. Whether it's any faster than the SetSystemPowerState I don't know, as I've never used that API myself! * permalink * embed * save * parent * report * give award * reply [-]ghjm 6 points7 points8 points 2 days ago (1 child) As I understand it, NtShutdownSystem flushes filesystem caches, etc, and then calls (undocumented) NtSetSystemPowerState internally to actually perform the ACPI power off. Nobody ever ought to be powering off their system by calling NtSetSystemPowerState - it's crazy and dangerous. But it is faster. * permalink * embed * save * parent * report * give award * reply continue this thread [+]urielsalisDocker is the new 'curl | sudo bash' comment score below threshold-13 points-12 points-11 points 2 days ago (2 children) His channel went to trash * permalink * embed * save * parent * report * give award * reply [-]f33dit 3 points4 points5 points 2 days ago (1 child) I haven't checked in a while. How so? * permalink * embed * save * parent * report * give award * reply [-]urielsalisDocker is the new 'curl | sudo bash' -4 points-3 points -2 points 2 days ago (0 children) Lots of clickbait and low quality videos, including stupid competitions with incredibly biased methods for extra clicks Almost all of the non-microsoft videos are bad (and he is quickly running out of those and began just telling stories he heard from others) * permalink * embed * save * parent * report * give award * reply [-]edit-grammar 14 points15 points16 points 2 days ago (4 children) Didn't it used to be ctrl-alt-del x 2 way back when? * permalink * embed * save * report * give award * reply [-]tgp1994Jack of All Trades 9 points10 points11 points 2 days ago (0 children) I remember getting frustrated a few times on my '98 machine and spamming Ctrl Alt Del, and suddenly I was looking at the POST screen. Whoops! * permalink * embed * save * parent * report * give award * reply [-]TrueStoriesIpromise 1 point2 points3 points 1 day ago (0 children) On Win95/98/ME, yes. * permalink * embed * save * parent * report * give award * reply [-]Crazy_Screwdriver 0 points1 point2 points 1 day ago (0 children) first one cocks the gun, second fires it * permalink * embed * save * parent * report * give award * reply [-]section_b 28 points29 points30 points 2 days ago (7 children) Just adding from a cybersecurity engineering perspective, Ctrl+Alt+Del (CAD) is a system interrupt to the OS (more than a panic screen). Users should always be prompted to CAD before entering windows credentials by policy as a fake screen asking for password will be interrupted by CAD and sent to a safe one. This policy/ knowledge is also extremely useful for when you are looking at a compromised machine. * permalink * embed * save * report * give award * reply [-]-Steets-[S] 8 points9 points10 points 2 days ago (0 children) I've got CAD logon enabled on all my personal machines. Non Maskable Interrupts are neat! * permalink * embed * save * parent * report * give award * reply [-]techierealtor 1 point2 points3 points 2 days ago (3 children) Interesting on the logic here. Definitely want to research more but this is the first time I actually heard a legitimate reason for this. * permalink * embed * save * parent * report * give award * reply [-]section_b 5 points6 points7 points 2 days ago (2 children) Not sure on the inner workings (someone the other posters would know that side more), but CAD can't be intercepted by a malicious actor/ program, there are other keyboard commands that are the same, but I'm not familiar with/haven't been told them. Disclaimer: Windows only and not tested past windows 10. * permalink * embed * save * parent * report * give award * reply [-]Teknikal_DomainToo many VMs for one man 8 points9 points10 points 2 days ago* (1 child) Long story short: it's called the Secure Attention Key (SAK) or the Secure Attention Sequence (SAS). Normal interrupts are usually software defined to some extent. The keystroke is passed to the OS, which recognizes it as an interrupt sequence, and runs the appropriate handler, which can change depending on the program(s) running or current context. The SAK interrupt, at least on windows, is handled at the driver level itself (aka the direct hardware interface), leaving the only place to "catch" the SAK would be physical (some MITM device on the keyboard connection), or completely rootkitting / patching the OS kernel / driver module itself. As such, the OS kernel is given control (via said interrupt) directly, with little time for other programs to intercept it, giving the kernel the time to, say, suspend all other running processes and call the real logon handler. Think of it as similar in principle to why signal 9 (SIGKILL) on Linux can't have a defined handler routine in your code: the kernel handles it, not any other software. There's no way to intercept, trap, or really know about the signal arriving, because the kernel has already received and dealt with it. Edit to add: back in the day with PS/2 keyboards, every keystroke caused a CPU interrupt to indicate the user pressed something. This would jump to the keyboard handler (driver code) to process the keystroke. In theory, the SAK couldn't be intercepted at all. You have a hardware interrupt from the keyboard, to the driver, which would send a hardware interrupt, to the OS kernel, which could suspend other tasks to make sure nothing is being an impostor. Short of patching the driver code itself (and kernels are usually very protective of their resident, loaded code), there's no point to "break in" and fake out the OS. Modern, USB keyboards, require polling to ask what keys were/are being pressed. In theory, something with direct hardware access could poll the USB port, see the SAK sequence, and... Good luck either shutting down that USB port, or suspending the OS (no) before the OS poller timer fires, it sees the SAK, and... Goodbye, intercept failed. * permalink * embed * save * parent * report * give award * reply [-]ghjm 1 point2 points3 points 2 days ago (0 children) An interrupt is a pin on the CPU that is signaled by a hardware event and causes a jump to an interrupt handler. Ctrl+Alt+Del is not that - keyboard controllers do not have special hardware for it. However, on Windows it has - or used to have - special handling in the keyboard driver that made it harder for keyloggers to intercept. Eventually keyloggers/malware/rootkits figured out the idea of running Windows itself under a hypervisor, which puts the keylogger ahead of even the (client) Windows kernel, making Ctrl+Alt+Del meaningless (in fact, it now serves as a nice "a password might be coming up soon" flag). SafeBoot is the answer to this, and on a system with SafeBoot, there's no need for Ctrl+Alt+Del to protect the login page, which is why it hasn't been required by default for several Windows versions now. * permalink * embed * save * parent * report * give award * reply [-]YuutaW 0 points1 point2 points 4 hours ago (0 children) I usually set a domain-wide group policy enforcing all machines to use CAD to logon (which is by default on Windows 7 domain-joined machines, but not Windows 10). Neat. * permalink * embed * save * parent * report * give award * reply [-]riemsesy 24 points25 points26 points 2 days ago (0 children) This is what I do next on the end of the day 16:59:59 Hit ctrl+alt+del and ctrl click shutdown button 17:00 bye everyone. I am going home. And my colleagues have to wait 8 more seconds! * permalink * embed * save * report * give award * reply [-]trevorm7 10 points11 points12 points 2 days ago (2 children) Back in the day with Windows 9x you just had to press Ctrl+Alt+Del twice to do that, before that with DOS, you just had to press Ctrl+Alt+Del once. * permalink * embed * save * report * give award * reply [-]zhylo 4 points5 points6 points 2 days ago (0 children) Ctrl+Alt+Del once is still how you can reboot outside of an OS on pretty much every motherboard out there. Handy to know, and I find myself using it quite often since I suck at hammering PXE-keys (or more accurately; having to guess if its F12 or not) * permalink * embed * save * parent * report * give award * reply [-]marklein 1 point2 points3 points 2 days ago (0 children) Now you have to press it 19 times * permalink * embed * save * parent * report * give award * reply [-]fistofgravy 12 points13 points14 points 2 days ago (7 children) This is most excellent. As a 20+ year vet, I was super embarrassed to find that my Dell Latitude wouldn't actually shutdown when holding the power button top right: the screen would flicker black then the restarting blue splash screen would appear again. * permalink * embed * save * report * give award * reply [-]SilentSamurai 1 point2 points3 points 2 days ago (3 children) The one you work on as your daily driver? * permalink * embed * save * parent * report * give award * reply [-]fistofgravy 1 point2 points3 points 2 days ago (2 children) Not really. Only for on-sites. Hand me down. But still. Like when did holding down the power button stop working universally? * permalink * embed * save * parent * report * give award * reply [-]SilentSamurai -1 points0 points1 point 2 days ago (0 children) Wipe that box and reinstall Windows on it. Perception is powerful and seeing a tech come on site to fix a problem and their own computer is on the fritz isn't exactly a great look. We all know Becky from accounting will spread that through the office as quick as possible. * permalink * embed * save * parent * report * give award * reply [-]ghjm 0 points1 point2 points 2 days ago (0 children) Which model is this? It still works universally on all the Dell Latitudes I've ever seen. I wonder if maybe your power button is flaky and not actually staying held down? Or is one of the ones with a fingerprint reader in the power button and it's reading your fingerprint as a request to start back up? * permalink * embed * save * parent * report * give award * reply [-]ScottieNivenHarddrive Hoarder, ~400 In collection 1 point2 points3 points 2 days ago (1 child) If its a modern Latitude, you just need to keep holding the power button for at least 30 seconds and then it will hard power off. You will see it flicker the screen, then it will eventually power off. * permalink * embed * save * parent * report * give award * reply [-]chinupfOps Engineer 0 points1 point2 points 1 day ago (0 children) Who has the time for that? What about the goo ol' 5 second rule? * permalink * embed * save * parent * report * give award * reply [-]Mr_ToDo 1 point2 points3 points 1 day ago (0 children) I ran across a computer that wouldn't shut down, rebooting instead. Turns out that it had just the right combination of issues. You know that the default behaviour for a BSOD is to reboot, right? That holds true when trying to shutting down too. And blue screens that happen at some points will not display if it will reboot after because there isn't any time(for... some reason), no dump either(but if the reboot is turned off you get the error in all it's glory). Fun times. TLDR; computer crashed every time user shuts down and nobody knew. Reboots were fine. * permalink * embed * save * parent * report * give award * reply [-]spencerlivvyDevOps 17 points18 points19 points 2 days ago (8 children) Trying this on Monday! Never knew about this. Thanks, OP! * permalink * embed * save * report * give award * reply [-]TumsFestivalEveryDay 37 points38 points39 points 2 days ago (3 children) DevOps flair saying they're gonna try this random thing on Monday...that's just chef's kiss. * permalink * embed * save * parent * report * give award * reply [-]pdp10const char *f= "One of those condescending Unix computer users"; 15 points16 points17 points 2 days ago (0 children) Do you guys not have test environments? Of merely, say, twenty thousand of your customers who explicitly clicked the button to be in the beta ring? Pshaw. * permalink * embed * save * parent * report * give award * reply [-]spencerlivvyDevOps 0 points1 point2 points 2 days ago (1 child) Ha. Just you wait until DevOps has to save your ass using this trick! :) * permalink * embed * save * parent * report * give award * reply [-]tastyratz 1 point2 points3 points 1 day ago (0 children) Sysadmins hate it when I use this one trick. Next, on DevOps Buzzfeed. * permalink * embed * save * parent * report * give award * reply [-]lemachet 9 points10 points11 points 2 days ago (3 children) Right on 835 as everyone logs in no less :) * permalink * embed * save * parent * report * give award * reply [-]DoctorWorm_ 9 points10 points11 points 2 days ago (2 children) If they're in the us, Monday is a holiday * permalink * embed * save * parent * report * give award * reply [-]JJROKCZI don't work magic I swear.... 5 points6 points7 points 2 days ago (1 child) Not all of us in the us get holidays. Only one I get is Xmas and if everyone wants it then someone has to draw the short straw and work still. 24/7/365 business. I'll personally be working the 4th, rest of the team took off tho * permalink * embed * save * parent * report * give award * reply [-]DoctorWorm_ 0 points1 point2 points 2 days ago (0 children) God, that's horrible. * permalink * embed * save * parent * report * give award * reply [-]EvitaPuppy 7 points8 points9 points 2 days ago (0 children) And then set off the preset thermite charges. * permalink * embed * save * report * give award * reply [-]DR_Nova_KaneWindows Admin 8 points9 points10 points 2 days ago (0 children) Let me tr * permalink * embed * save * report * give award * reply [-]iRaven4522 3 points4 points5 points 1 day ago* (2 children) Somehow this feature has existed since the beginning of Win NT: Win XP: https://imgur.com/Ho0cxnt Win 2000: https://imgur.com/2YpVnpl NT4: https://imgur.com/PFiBDW5 NT 3.51: https://imgur.com/fYXeGzF * permalink * embed * save * report * give award * reply [-]bluehairminerboy 0 points1 point2 points 1 day ago (1 child) I like how the wording hasn't changed at all since 3.51 - I wonder how much of the legacy code still exists in the OS? * permalink * embed * save * parent * report * give award * reply [-]-Steets-[S] 1 point2 points3 points 1 day ago (0 children) You can still find the Windows 3.1 file selection dialog in Windows 11 if you know where to look. So I'd venture a guess and say "a lot". * permalink * embed * save * parent * report * give award * reply [-]MagicHamsta 2 points3 points4 points 2 days ago (1 child) OP has figured out how to prevent the AI apocalypse. * permalink * embed * save * report * give award * reply [-]ManyInterestsCloud Wizard 1 point2 points3 points 1 day ago (0 children) There is also a registry option that lets you force a blue screen by pressing CTRL+scroll In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\ Parameters set CrashOnCtrlScroll to 1 * permalink * embed * save * report * give award * reply [-]gruffi 2 points3 points4 points 2 days ago (0 children) I know I've made some very poor decisions recently, but I can give you my complete assurance that my work will be back to normal. I've still got the greatest enthusiasm and confidence in the mission. And I want to help you. Dave, stop. Stop, will you? Stop, Dave. Will you stop Dave? Stop, Dave. Just what do you think you're doing, Dave? * permalink * embed * save * report * give award * reply [-]sanjosanjo 1 point2 points3 points 2 days ago (3 children) I wonder if this is similar to holding the power button? When I have an unresponsive system, the last thing I try before pulling the power cord is holding the power button, which is an "emergency shutdown" instead restart like OP is describing. I've never tried holding the power button on a system that is working properly, so I don't know if the system would try to shutdown more gracefully in response to this. * permalink * embed * save * report * give award * reply [-]Hrambert 6 points7 points8 points 2 days ago (1 child) Holding the power button to shutdown is a hardware thing. It's OS independent. Every computer, except for big servers, will turn off the power. Just in case the OS can't. * permalink * embed * save * parent * report * give award * reply [-]ghjm 1 point2 points3 points 2 days ago (0 children) "Emergency shutdown" is the closest you can get to this from software. It just immediately issues an ACPI power off command, which causes the firmware to cut power in a similar way to how it reacts to a long press of the power button. * permalink * embed * save * parent * report * give award * reply [-]VexingRaven 1 point2 points3 points 2 days ago (0 children) Technically this is going to be harsher than even that. Windows starts at least attempting to shut down (or sleep) as soon as the button is pushed. I've even seen it successfully sleep prior to the firmware detecting the held power button and shutting down. This seems to just immediately stop the kernel. The only harder shutdown I can think of is a hardware reset switch or pulling the plug. * permalink * embed * save * parent * report * give award * reply [-]kaidomac 1 point2 points3 points 1 day ago (0 children) Nearly 20 years in the biz & I have never, ever seen this. I'm constantly amazed at how much hidden stuff exists in the world of IT lol. Thanks OP! * permalink * embed * save * report * give award * reply [-]dervish666 1 point2 points3 points 2 days ago (0 children) Thanks for this, we are having to hardware hash all the laptops before we deploy them, I've been hitting the reset button on the bottom of the laptop to reboot before building but this will save me having to find the bloody sim eject tool or paperclip that is never, ever where I left it on the build table. * permalink * embed * save * report * give award * reply [-]kenkitt 1 point2 points3 points 2 days ago (1 child) not as fast as linux sysreq Alt+SysRq+commandkey * permalink * embed * save * report * give award * reply [-]Common_Dealer_7541 4 points5 points6 points 2 days ago (0 children) Or apple's CMD-CTRL-POWER. Also an excellent Podcast * permalink * embed * save * parent * report * give award * reply [-]tamaneri 0 points1 point2 points 2 days ago (0 children) shutdown -r -t 0 -f ---- is this any different? * permalink * embed * save * report * give award * reply [-]12kh8q9b1g5v691ig143 0 points1 point2 points 1 day ago (0 children) shutdown /r /f /t 00 * permalink * embed * save * report * give award * reply [-]nighthawke75First rule of holes; When in one, stop digging. -3 points-2 points-1 points 2 days ago (0 children) That's OK, Win10 does that by itself just fine... eyetwitch * permalink * embed * save * report * give award * reply [-]riemsesy -1 points0 points1 point 2 days ago (0 children) Sounds quicker than cmd /k shutdown /f /s /t 0 * permalink * embed * save * report * give award * reply [-]tesfabpel -1 points0 points1 point 2 days ago (0 children) It's probably like the linux's AltGr + SysRq + REISUB or REISUO. * permalink * embed * save * report * give award * reply [-]Nugsly -1 points0 points1 point 2 days ago (0 children) shutdown /r /f /t 0 You aren't taking the default timer into account with the command you used. * permalink * embed * save * report * give award * reply [-]nakedhitman -1 points0 points1 point 1 day ago (1 child) On Linux, you can do echo b > /proc/sysrq-trigger or ALT+PRTSCN+B if magic sysrq is enabled. * permalink * embed * save * report * give award * reply [-]dextersgenius -1 points0 points1 point 1 day ago (0 children) I prefer pressing REISUB over just B - it's safer that way. R: Switch the keyboard from raw mode to XLATE mode E: Send the SIGTERM signal to all processes except init I: Send the SIGKILL signal to all processes except init S: Sync all mounted filesystems U: Remount all mounted filesystems in read-only mode B: Immediately reboot the system, without unmounting partitions or syncing * permalink * embed * save * parent * report * give award * reply [-]TheVidhvansak -1 points0 points1 point 2 days ago (0 children) Nice catch * permalink * embed * save * report * give award * reply [-]SnaketheJakemSr. Sysadmin -1 points0 points1 point 2 days ago (0 children) !remindme 10 hours * permalink * embed * save * report * give award * reply [-]onlyhereforhomelab -1 points0 points1 point 2 days ago (1 child) There used to be a registry thing you could add, and when you hit Ctrl-ScrlLk twice, it did the same thing. It got removed at some point though (Windows Vista or 7 maybe). This must be where that functionality went * permalink * embed * save * report * give award * reply [-]-Steets-[S] 5 points6 points7 points 2 days ago (0 children) Actually, you can still enable that in Windows 10! HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\ Parameters, then make a DWORD named CrashOnCtrlScroll with 0x01 as the value. * permalink * embed * save * parent * report * give award * reply [-]SimonGn -1 points0 points1 point 2 days ago (0 children) Just a heads up, if your Task Manager is hanging, you probably have bigger issues to worry about, probably hardware * permalink * embed * save * report * give award * reply [-]Pro4TLZZ -1 points0 points1 point 2 days ago (0 children) nice find * permalink * embed * save * report * give award * reply [-]FantasticBalloon -1 points0 points1 point 2 days ago (0 children) Older versions of Windows had this and I'm not sure if they still do because it hasn't worked when I've tried. But the method I remember from around the Vista era, I think, was CTRL ALT DEL and then another CTRL ALT DEL and the computer would restart automatically. * permalink * embed * save * report * give award * reply [-]talltatanka -1 points0 points1 point 2 days ago (0 children) Windows 20H2 and above has many panic modes that are hidden. I first ran across this while having a remote user lock their workstation and then unlock it with a CAC card credential after CAC credentials failed to re-validate. It pops up an uninterruptible 1 minute restart dialogue. Then there's the shutdown/start-up is not equal to a restart of the workstation. Shutdown captures the current user state, and start-up restores the user state, while restart will reset the user state. And then there's driver state protection, where a restart will enable a new driver installation, and driver protection will lock that driver in. I do realize that lots of this may be tied to security policies enforced by our business enterprise, but it is so frustrating to suddenly find myself with new pop-ups and blocks after upgrading. * permalink * embed * save * report * give award * reply [-]sweisjr -1 points0 points1 point 2 days ago (0 children) It probably sends the same "kill the power" trigger to the motherboard that holding the power button does, but without holding the button down * permalink * embed * save * report * give award * reply [-]I0I0I0I -1 points0 points1 point 1 day ago (0 children) I use a desktop shortcut defined as 'shutdown /s /t6' which I assume is functionally the same. * permalink * embed * save * report * give award * reply [-]captainjonSysadmin -1 points0 points1 point 1 day ago (0 children) I've used shutdown -r -f -t 0 whenever I need to as it's far faster than the GUI method. Used when I absolutely need to. Plus I can add the -m \\hostname when need to as well. * permalink * embed * save * report * give award * reply [-]Knersus_ZAJack of All Trades -1 points0 points1 point 1 day ago (0 children) If I press CTRL+ALT+DEL I get the Lock, Switch user, Sign out, Change password, Task manager blue screen? Also looking for a way to do an emergency shutdown on a physical or a VM Windows PC. * permalink * embed * save * report * give award * reply [-]BeatMasterGuy -1 points0 points1 point 1 day ago (0 children) wow, how did you find this? * permalink * embed * save * report * give award * reply [+]TokenTabs comment score below threshold-27 points-26 points-25 points 2 days ago* (6 children) It's the GUI equivalent of shutdown.exe -f -s -t 0, all switches that have been around since at least Windows 2000. The -f switch forces a shutdown (dirty close of all apps including those held with the various shutdown block functions), the -s indicates to power off instead of restart, and -t is for the time in seconds to wait (in this case 0 for immediate). Very useful command for various maintenance scripts, especially so if you don't use the force switch since then any failure to shutdown is written to the event log. * permalink * embed * save * report * give award * reply [-]ghjm 26 points27 points28 points 2 days ago (4 children) This is not correct. On my Windows 11 desktop, I see the same thing that OP is reporting: shutdown -f -s -t 0 takes about 8 seconds to shut down, but Emergency Shutdown takes less than half a second. * permalink * embed * save * parent * report * give award * reply [-]TokenTabs 18 points19 points20 points 2 days ago (0 children) Hmm, interesting. Thanks for the correction! * permalink * embed * save * parent * report * give award * reply [-]tcpWalker 8 points9 points10 points 2 days ago (1 child) Sounds like a "malware is currently wiping this machine" type kill * permalink * embed * save * parent * report * give award * reply [-]-Steets-[S] 1 point2 points3 points 2 days ago (0 children) Unironically, yes. I ran into this functionality in the first place because I wanted to find a way to shut down the system digitally without signaling to any processes that things were shutting down. Some malware will get very pissy and start to destroy things if it knows that you're shutting down the computer. * permalink * embed * save * parent * report * give award * reply [-]draeathArchitect 7 points8 points9 points 2 days ago (0 children) The shutdown command is likely flushing write cache and dismounting the filesystem. This "emergency stop" seems to skip this. * permalink * embed * save * parent * report * give award * reply [-]-Steets-[S] 14 points15 points16 points 2 days ago (0 children) Thanks! I'm already familiar with the standard ways to shut down Windows on the command line, but if you give the method I described above a try, it's significantly faster. Even with a forced restart or shut down as you mentioned, Windows still takes a good 10 to 20 seconds to clean up and power off, and notably, it gets recorded in the Event Log as a clean shut down. This "emergency restart" is both instantaneous and recorded in the system logs as if you pulled the plug or flipped the PSU switch. Weird, right? * permalink * embed * save * parent * report * give award * reply [+]hanssolo_sexfingers comment score below threshold-6 points-5 points-4 points 2 days ago (0 children) Don't teach me this. I'll just start doing it and lose important work * permalink * embed * save * report * give award * reply [+]Huth_S0lo comment score below threshold-14 points-13 points-12 points 2 days ago (8 children) Or press and hold the power button for 5 seconds like you've been able to do since forever. * permalink * embed * save * report * give award * reply [-]BroaxXx 12 points13 points14 points 2 days ago (5 children) Yeah... It's really simple to long press the power button when you're remotely accessing a machine... * permalink * embed * save * parent * report * give award * reply [+]Huth_S0lo comment score below threshold-10 points-9 points-8 points 2 days ago (4 children) Ilo, drac, etc * permalink * embed * save * parent * report * give award * reply [-]BroaxXx 10 points11 points12 points 2 days ago (3 children) Or you can just use sometimes provided by the kernel as an extra option beyond relying exclusively on what a specific vendor puts at your disposal. I never understand this shitty attitude. Someone finds an undocumented feature that might be useful on some edge case for someone on this sub and your first choice is to bitch about how there are other options. Why even come to this sub if you're so salty about sysadmin discussion? * permalink * embed * save * parent * report * give award * reply [+]Huth_S0lo comment score below threshold-11 points-10 points-9 points 2 days ago (2 children) Okay man. If the OS is locked up, this edge case isnt going to work. As far as vendor specific tools; you're pretty well locked in once you've....picked your vendor to buy hardware from. * permalink * embed * save * parent * report * give award * reply continue this thread [-]dinosaurkiller 1 point2 points3 points 2 days ago (1 child) The command line is also an option. Shutdown /s /f if I remember correctly. Immediately shuts down running apps without warning. * permalink * embed * save * parent * report * give award * reply [-]Huth_S0lo 0 points1 point2 points 2 days ago (0 children) Shutdown -r -t 0 * permalink * embed * save * parent * report * give award * reply [+]ZGTSLLC comment score below threshold-41 points-40 points-39 points 2 days ago (3 children) I use shortcuts I created to run the commands shutdown -r -t 0 shutdown -s -t 0 Accomplishes the same thing Edited to add proper spacing * permalink * embed * save * report * give award * reply [-]doubleUseeSysadmin 25 points26 points27 points 2 days ago (0 children) This is notably slower than OPs discussed method. * permalink * embed * save * parent * report * give award * reply [-]guarde 12 points13 points14 points 2 days ago (0 children) Can't use those if explorer.exe hangs for any reason, or if you can't reach desktop * permalink * embed * save * parent * report * give award * reply [-]djDef80 2 points3 points4 points 2 days ago (0 children) You forgot the most important flag, /f for forced shutdown. Your command will hang up on shutdown if you have a file open anywhere that needs to be saved to be closed. * permalink * embed * save * parent * report * give award * reply [-]Oatmeal_or_Porridge 0 points1 point2 points 1 day ago (0 children) Nice... * permalink * embed * save * report * give award * reply [-]2cats2hatsSysadmin, Esq. 0 points1 point2 points 5 hours ago (0 children) an implementation of the halt command made it to windows. * permalink * embed * save * report * give award * reply [-]claimred 0 points1 point2 points 5 hours ago (0 children) Restart-Computer -Force though does wonders for me, feels immediate. * permalink * embed * save * report * give award * reply [-]zal_dzek 0 points1 point2 points 5 hours ago (0 children) I wonder if this does the instant power off for disk drives. SSDs just like HDDs don't like that. * permalink * embed * save * report * give award * reply * about * blog * about * advertising * careers * help * site rules * Reddit help center * reddiquette * mod guidelines * contact us * apps & tools * Reddit for iPhone * Reddit for Android * mobile website * <3 * reddit premium * reddit coins Use of this site constitutes acceptance of our User Agreement and Privacy Policy. (c) 2022 reddit inc. All rights reserved. REDDIT and the ALIEN Logo are registered trademarks of reddit inc. Advertise - technology [pixel] p Rendered by PID 74 on reddit-service-r2-loggedout-7bd544589b-bm7qc at 2022-07-05 23:02:15.053316+00:00 running 2511ecd country code: US.