How Windows 95 Handled Third-Party Shutdowns

In Windows 95, third-party software initiated system shutdowns primarily through the ExitWindowsEx Win32 API, triggering an orchestrated broadcast to evaluate application readiness, terminate processes, and unwind the operating system layers. This process relied on standard Windows messaging to give running applications an opportunity to save data or cancel the request, followed by system-level cleanup across both 16-bit and 32-bit environments. Finally, the system flushed file caches and handed control over to the Virtual Machine Manager (VMM32) to transition into real-mode MS-DOS, power down via APM, or display the iconic shutdown screen.

The Entry Point: ExitWindowsEx

When a third-party application needed to shut down, restart, or log off the computer, it invoked the ExitWindowsEx function (or the legacy 16-bit ExitWindows function). The caller passed specific flags defining the operation:

  • EWX_SHUTDOWN: Safe shutdown to the point where power can be turned off.
  • EWX_REBOOT: System shutdown followed by a hardware restart.
  • EWX_LOGOFF: Terminating the shell and logging out the current user.
  • EWX_FORCE: Forcibly closing applications that refuse or fail to respond.

Unless the EWX_FORCE flag was set, Windows 95 treated the shutdown request as a cooperative negotiation between the operating system and all active applications.

The Query Phase: WM_QUERYENDSESSION

Upon receiving the API call, the Windows USER subsystem began broadcasting the WM_QUERYENDSESSION message to every top-level window. This query moved sequentially through active processes:

  1. Each application received WM_QUERYENDSESSION with an optional lParam indicating logoff status.
  2. If an application had unsaved changes, it typically displayed a prompt asking the user whether to save, discard, or cancel.
  3. If any application returned FALSE (0), Windows 95 immediately aborted the shutdown process, returning control to the desktop without closing other programs.
  4. If the application returned TRUE (non-zero), the subsystem proceeded to the next top-level window.

The Termination Phase: WM_ENDSESSION

Once all running applications acknowledged the WM_QUERYENDSESSION with an approval, the system committed to the shutdown sequence:

  1. The USER subsystem broadcasted WM_ENDSESSION to the top-level windows with the wParam parameter set to TRUE.
  2. Applications used this event to finalize database transactions, delete temporary files, and perform last-minute cleanup before terminating.
  3. Applications were expected to close themselves promptly; unresponsive programs were subjected to a timeout dialog, asking the user whether to wait or forcibly end the task.
  4. Windows closed 32-bit Win32 processes, handled 16-bit Win16 tasks running within the cooperative Win16 subsystem, and terminated active MS-DOS virtual machines.

Driver and Kernel Teardown

After user-mode applications finished executing, the core graphical subsystems (USER.EXE and GDI.EXE) closed down. The system then handed control back to the 32-bit Ring 0 components:

  1. Virtual Device Drivers (VxDs): The Virtual Machine Manager (VMM) notified loaded VxDs of the impending shutdown via control messages such as Sys_Critical_Exit and DEVICE_SHUTDOWN. Network drivers unmounted remote shares, and hardware drivers prepared controllers for reset or power-off.
  2. Disk Cache Flushing: The 32-bit file caching system (VCACHE) flushed all unwritten data blocks to physical drives, ensuring the FAT file systems were left in a clean, consistent state.

Final Execution and Power Management

The final phase depended on the hardware capabilities of the machine and the flags originally passed to ExitWindowsEx:

  • Advanced Power Management (APM): If the motherboard and BIOS supported APM, Windows 95 issued an APM power-down call via the APM BIOS driver to immediately cut power to the machine.
  • Restart: If EWX_REBOOT was called, the system tripped an intentional CPU reset (via the keyboard controller or direct BIOS vector jump) to reboot the computer.
  • Manual Power Off: If APM was unavailable or disabled, Windows 95 switched the display into standard VGA mode (320x400 at 256 colors), drew the bitmap file LOGOS.SYS—displaying the message "It's now safe to turn off your computer"—and entered an infinite halt loop.