Windows Logs Off when Shutdown or Hibernate is used

Over these years, at least since the Windows 7 era, we’ve seen several cases where the system logs you off when clicking on the Shutdown or Hibernate option in the Start menu. The problem may be seen in Windows 8, Windows 10, or 11 systems as well.

What causes Windows to log off the account instead when the shutdown or hibernate option is used?

Cause

During hibernation, Windows reads the contents in the memory and dumps it into a file named hiberfil.sys on the system drive’s root. The crash dump feature uses the same technology to dump the memory contents to a file (.dmp) on your hard disk after a system crash. Both hibernate and crash dump features use a special filter driver named dumpfve.sys to do the task of dumping the memory to a file.

The file dumpfve.sys is mentioned in the following registry key, in a REG_MULTI_SZ value named DumpFilters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

The multi-string registry value allows third-party providers to add the crash dump filter drivers — e.g., Truecrypt.sys from TrueCrypt, MfeEpeOpal.sys from McAfee Endpoint Encryption, or Daemon Tools filter driver, etc. Most disk encryption products typically also want to encrypt hibernation & crash dump files and add their dump filters in the above registry key.

The dump filter drivers mentioned in the registry key are loaded when crash dump or hibernation is initialized. If Windows is unable to load the filter drivers during the hibernate process, it generates an event log entry with the Event ID 45. The event log entry looks like the following:

Log Name: System 
Source: volmgr 
Event ID: 45 
Task Category: None 
Level: Error 
Keywords: Classic 
Description: 
The system could not successfully load the crash dump driver.

Additionally, when you go to the Details tab in this event and then select friendly view, you may notice the following:

Binary data:

In Words

0000: 00000000 00000001 00000000 C004002D 
0010: 00002005 C0000034 00000000 00000000 
0020: 00000000 00000000

C0000034 - means STATUS_OBJECT_NAME_NOT_FOUND

C004002D - means IO_DUMP_DRIVER_LOAD_FAILURE

The problem may occur during the shutdown as well. How?

If Fast Startup is enabled, the system logs off all the user sessions completely and then hibernates the system instead of performing a clean shut down. Fast Startup relies upon the hibernation feature, dumping the kernel memory to hiberfil.sys file. When the fast startup is enabled and a user shuts down the computer, all sessions are logged off, and the computer is supposed to enter hibernation. As part of the hibernation process, Windows initializes the system’s memory dump configuration. If the filter driver(s) is not loaded, it fails to hibernate, and brings you back to the Windows lock screen or the sign-in screen.

RELATED: Disable Hibernation Without Disabling Fast Startup

Workarounds

To avoid the problem from happening during shutdown (not hibernate), you can disable fast startup or bypass fast startup during shutdown on a per-session basis by running the command shutdown.exe /s /t 0 to shut down the computer.

Or, disable Fast Startup via Power Options:

1. Open Control Panel → All Control Panel Items → Power Options (or run powercfg.cpl)
2. Click Choose what the power buttons do
3. Click Change settings that are currently unavailable
4. Uncheck Turn on fast startup
5. Click OK.

However, turning off fast startup is a compromise. It’s not a feasible thing to do for most users, as the restart process in Windows continues to perform a full boot cycle, without the hibernation performance benefits.

Resolution

To fix the problem, remove third-party crash dump filter driver references from the registry using the following steps:

1. Start the Registry Editor (regedit.exe) and go to the following key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

2. Backup the key by exporting it to a .reg file.
3. Double-click the DumpFilters multi-string value.
4. Remove all the third-party filter drivers listed in the value. Note that the Windows default driver dumpfve.sys should not be removed.
   
5. Exit the Registry Editor.
6. Restart Windows.

The hibernate and shutdown features should now work correctly — with or without Fast Startup enabled.

If you want to resolve the issue without removing 3rd party dump filter drivers, contact the software vendor for an updated version of their product to support the latest version and build of Windows — e.g., Windows 10 v22H2.