Shutdown reason codes are reason codes, not error codes or HRESULTs

Raymond Chen

A customer liaison asked the following question on behalf of his customer:

My customer is finding that their Windows Server 2003 system has restarted, and they want to find out why. I’ve found some event log similar to the ones below, but I don’t know what error code 0x84020004 is. I’ve searched the Knowledge Base but couldn’t find anything relevant. Please let me know why the system restarted.

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 3/20/2009
Time: 11:51:30 AM
User: GROUP1\infraadmin
Computer: DATA2
Description:
The process Explorer.EXE has initiated the shutdown of computer SYSP1 on behalf
of user GROUP1\infraadmin for the following reason: Operating System:
Reconfiguration (Planned)
Reason Code: 0x84020004
Shutdown Type: restart
Comment:

The value 0x84020004 is not an error code. It says right there that it’s a reason code:

Reason Code: 0x84020004

The system shutdown reason codes are documented in MSDN under the devious heading System Shutdown Reason Codes. In this case, the value 0x84020004 is a combination of

SHTDN_REASON_FLAG_PLANNED               0x80000000
SHTDN_REASON_FLAG_CLEAN_UI              0x04000000 // reason.h
SHTDN_REASON_MAJOR_OPERATINGSYSTEM      0x00020000
SHTDN_REASON_MINOR_RECONFIG             0x00000004

That value for SHTDN_REASON_FLAG_CLEAN_UI is missing from the MSDN documentation for some reason, but’s listed in reason.h. The flag means that the system was shut down in a controlled manner, as opposed to SHDTN_REASON_FLAG_DIRTY_UI which means that the system lost power and did not go through a clean shutdown.

In other words, this was a planned shutdown that was the result of an operating system reconfiguration. Perhaps somebody changed a system setting in the Control Panel, and in response to the question “The change you made requires that the system be restarted. Restart now?”, the person said Yes.

Raymond Chen

Follow