How Windows 2000 Clears Pagefile at Shutdown

This article explains the mechanism Microsoft Windows 2000 uses to wipe the paging file (pagefile.sys) during system shutdown. It details the underlying operating system process, the specific registry settings that enable the feature, and how the Windows Memory Manager overwrites virtual memory contents to prevent unauthorized data recovery.

In Microsoft Windows 2000, paging file sanitization is managed by the Windows Memory Manager (Mm) subsystem. By default, Windows 2000 does not clear the pagefile upon shutdown; it simply marks the space as available for the next boot, leaving residual unencrypted data on the storage drive.

To enforce sanitization, Windows 2000 relies on the ClearPageFileAtShutdown registry value located within the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

When this REG_DWORD value is set to 1 (either directly or via the Local Security Policy setting named "Clear virtual memory pagefile when system shuts down"), the operating system initiates a zero-overwrite routine during the final phase of the shutdown sequence.

Once all user-mode processes, services, and core system components terminate, the Memory Manager halts normal virtual-to-physical memory mapping and takes exclusive access to pagefile.sys. The kernel then sequentially writes zeros (0x00) across all active blocks allocated to the pagefile on disk.

Because this mechanism involves physical disk writes to the entire allocated size of the paging file rather than simply unlinking the file table, the system remains in the shutdown state until the writing process completes. Once the entire designated storage space is filled with zeros, the operating system unmounts the file system and powers off or halts the machine.