| Previous | Next |
| ERROR_MULTIPLE_FAULT_VIOLATION | ERROR_PORT_NOT_SET |
ERROR_SYSTEM_SHUTDOWN
What ERROR_SYSTEM_SHUTDOWN means
During shutdown, services, sessions, devices, and system components are torn down in a controlled order. Calls that require components already stopping can return this code even though they would normally succeed.
Where it commonly appears
- Service control handlers
- Late writes and network calls during process shutdown
- Installers or updaters racing with restart
- Background workers that ignore the stop signal
Likely causes
- The operation began after shutdown was initiated
- A worker continued after its owning service entered stop-pending
- An external restart policy interrupted a long transaction
- Cleanup order calls a dependency after that dependency has stopped
Diagnostic checklist
- Record when shutdown was announced relative to the failed call
- Inspect service-control and system shutdown events
- Check whether worker threads honor cancellation promptly
- Trace dependency teardown order
- Determine whether an installer or administrator initiated the restart
Guidance for developers
Treat the code as a terminal cancellation for most new work. Stop accepting requests, commit only bounded essential state, and avoid starting replacement processes. Design operations so they can resume safely after reboot.
Guidance for administrators
Allow shutdown to complete. If the status appears during routine service stops, investigate slow or misordered application cleanup rather than blocking system shutdown indefinitely.
Example incident
A service receives the stop control but leaves a queue consumer running. The consumer starts a new network transaction after networking components begin shutdown and receives this code. Canceling the queue before dependency teardown fixes the race.
Related conditions
This differs from ERROR_SHUTDOWN_IN_PROGRESS only by the specific API path and code family; both indicate that shutdown state, not ordinary resource failure, is controlling the result.
Operational decision points
Operational triage should begin by deciding whether the report represents a shutdown cancellation condition and not merely a transient API failure. For ERROR_SYSTEM_SHUTDOWN, the deciding evidence is shutdown initiator, stop notification, worker state, dependency order, transaction. Preserving this first-occurrence evidence is more useful than increasing retry frequency for investigation sequence 22.
- Impact boundary: identify the exact process, account, device, file, session, host, or connection affected by this result; do not assume the whole machine is in the same state.
- State change required: the next attempt is justified only after the relevant shutdown cancellation state can differ from the failed attempt.
- Partial outcome: verify whether the operation allocated resources, changed data, sent a request, or modified policy before this result was returned.
- Escalation evidence: preserve shutdown initiator, stop notification, worker state, dependency order, transaction together with component version and the first preceding failure.
Concrete recovery example
Consider a case where a queue worker started new network work after its service received stop. Repeating the same call leaves the underlying condition unchanged and produces another this result. The durable response is to cancel new work and resume idempotently after startup. Validation for it should use one controlled operation and inspect both the returned status and the resulting state associated with case 22.
Monitoring and validation
A monitoring rule for it should distinguish first occurrence from repetition, group events by affected object, and correlate them with deployments or configuration changes. The recovery is complete only when the expected shutdown cancellation state is present and consistent; absence of another log line by itself is not sufficient proof.
Retain the original this result event until validation for investigation case 22 is complete. After it is corrected, verify that no partial or stale artifact specific to remediation sequence 22 remains before declaring recovery complete. This it-specific verification prevents a hidden secondary problem from surviving after remediation step 22.
References
Looking for a different code? Search another status or error code.