What is the difference between a restart and a shutdown in Windows?

A restart performs a full boot cycle: Windows is torn down and built again from scratch. A shutdown, on almost every modern Windows PC, does not. Because a feature called Fast Startup is switched on by default, shutting down closes your programs and signs you out, but then saves the core of Windows, the kernel, along with its loaded hardware drivers, into a file on the disk called hiberfil.sys rather than clearing them. Switching the machine back on reloads that saved copy. Microsoft states it in one sentence: "The Fast Startup setting doesn't apply to Restart." That is why Blue Arc IT Solutions asks staff to restart, not shut down, before logging a ticket.

The three ways Windows can start

Two words first, because everything below needs them. The kernel is the core of Windows: the part that talks directly to your hardware and keeps memory, devices and drivers in order. Drivers are the small pieces of software that make your screen, Wi-Fi, printer, sound and USB ports work. You never interact with either of them directly, which is exactly why a problem down at that level is both invisible and stubborn.

Microsoft's driver documentation lists three startup modes: cold (traditional), wake-from-hibernation, and fast startup, which combines the first two and arrived in Windows 8. During a cold startup, "the boot loader constructs a kernel memory image by loading the sections of the Windows kernel file into memory and linking them", after which the kernel configures core system functions, enumerates attached devices and loads drivers for them. In other words, Windows builds itself from the ground up and finds your hardware again. A fast startup skips all of that: it "simply loads the hibernation file (Hiberfil.sys) into memory", the saved copy from last time.

In everyday terms: shutting down clears your desk and sends everyone home, but leaves the building's wiring, phones and lifts exactly as they were. Restarting resets the whole building. That single difference, building a kernel from scratch versus loading a saved one, is the whole story. See Microsoft Learn on distinguishing fast startup from wake-from-hibernation.

What a shutdown actually does, step by step

Microsoft describes the hybrid shutdown sequence in three stages. First, as in a full shutdown, Windows closes all applications and logs off all user sessions: "At this stage, no applications are running, but the Windows kernel is loaded and the system session is running." Second, the power manager sends system power requests to device drivers telling them to prepare their devices for hibernation. Third, "Windows saves the kernel memory image (including the loaded kernel-mode drivers) in Hiberfil.sys and shuts down the computer."

Microsoft's plainer summary of the same behaviour: "During Fast Startup, the kernel session is not closed, but it is hibernated." The machine is genuinely powered off, and the drive light is genuinely dark. The kernel that comes back is the one you had before.

What a restart does differently

Restart never takes that path, deliberately. Microsoft's explanation is worth quoting because it states the intent: "When you restart the computer, this typically means that you want a completely new Windows state, either because you have installed a driver or replaced Windows elements that cannot be replaced without a full restart." The same article draws the conclusion: "Therefore, the restart process in Windows continues to perform a full boot cycle, without the hibernation performance improvement that's described in this article."

So a restart discards the old kernel, builds a fresh one, detects your hardware again, reloads every driver from disk, and starts Windows services in order, each waiting for whatever it depends on. A shutdown followed by a power on does none of that.

So what does each one actually clear?

A shutdown and power on clears your programs, your sign-in session, and anything an open application was still holding on to. That is not nothing: it fixes the misbehaving application, the spreadsheet that had grown to several gigabytes, the browser with 200 tabs.

It does not clear the kernel, the kernel-mode drivers loaded into it, or the network stack, meaning the layers of Windows that move traffic on and off the machine. And that is exactly where the faults which annoy people most tend to live: the Wi-Fi that never comes back properly after unplugging a dock, the printer or scanner stuck in an error state, the VPN that will not connect, the sound device that has vanished from the list, the second monitor the laptop now refuses to detect. A restart clears both layers. A shutdown preserves the layer you needed cleared.

That is the practical answer to why restarting fixes so much, and why shutting down every night can leave a user convinced they have already tried it.

Why a restart fixes things a shutdown does not

Pending updates finish. Microsoft is explicit: "Installation of some Windows updates can be completed only when starting your computer after a full shutdown. Since Fast Startup uses hibernation instead of a full shutdown, installation of those updates will not be completed before a full shutdown. In order to make sure pending updates are completed, you have to choose Restart from the Power menu." That article, on updates not installing with Fast Startup, is labelled for Windows 10 and was last refreshed on 12 February 2026; the mechanism it describes is unchanged in Windows 11.

Locked files get replaced. Windows cannot overwrite a file that is in use, so patched components are queued and swapped in early during boot, before the things holding them open have started.

Drivers and devices are reloaded and re-enumerated from scratch, which is the fix for most of the device faults in the previous section.

Windows services start again in the right order, so one that failed last time because something it needed was not ready yet gets a fresh attempt in the correct sequence.

Memory and system handles that long-running programs have leaked are handed back. A machine that has been running for a month has been leaking for a month.

Settings and policies applied to the machine by whoever manages it, some of which only take effect at startup, finally land. That is why a laptop which has been away from the office for weeks often needs a restart before a new setting appears.

What a restart will not fix

Restarting is a cheap first step, not a cure. It will not fix failing hardware, a full system drive, an expired password or licence, a service outage at the other end, a misconfiguration, or a compromised account. If a fault returns within minutes of every restart, that is useful information: tell us, because it points at something persistent rather than transient. And if there is any sign of compromise, do not restart at all, since it destroys volatile evidence without removing the cause. See the Windows self-help overview for what to escalate immediately.

"Update and shut down" and why it used to lie to you

Choosing "Update and shut down" could leave the machine sitting at the sign-in screen instead of powered off, a long-standing complaint. The reason is that finishing an update means restarting into a special servicing mode, where Windows can replace files it cannot touch while it is running. Microsoft addressed it in KB5067036, the non-security preview released on 28 October 2025 for Windows 11 versions 24H2 and 25H2 (OS builds 26100.7019 and 26200.7019), whose release notes list: "Addressed underlying issue which can cause 'Update and shutdown' to not actually shut down your PC after updating."

Worth knowing if you have wondered whether you imagined it. It does not change the guidance, though: Restart is still the option Microsoft's own documentation points to for completing pending updates.

How to force a genuine full shutdown

If you are not the person who looks after these machines, you can skip this section: a restart is all you need. Occasionally, usually for firmware or hardware diagnosis, someone does want a true cold boot. Running shutdown /s /t 0 from the Run box or a terminal does it, because Microsoft notes that full shutdown is the default when you use Shutdown.exe. The optional /hybrid switch (shutdown /s /hybrid /t 0) requests the fast-startup version instead. Holding Shift while clicking Shut down in the Start menu is the common shortcut for the same result.

You rarely need any of this for ordinary troubleshooting, because a restart already performs a full boot cycle. Microsoft also states directly that "Disabling Fast Startup is not recommended", and turning hibernation off with powercfg /h off to achieve it removes hibernate along with it, though it does reclaim the disk space hiberfil.sys occupies. That is a fleet-wide decision for whoever manages the devices, not a per-user tweak.

Why this matters more in 2026 than it used to

The short version, if you just want to know what to do: Windows probably still makes you restart once a month, and you should restart weekly regardless. The detail below matters mainly to whoever manages the computers, because it is widely misreported.

Windows is asking for fewer restarts than it once did, on the fleets that qualify. Hotpatch updates, which Microsoft describes as Monthly B release security updates that "install and take effect without requiring you to restart the device", are enabled by default for all eligible devices in Microsoft Intune. The calendar is four baseline months a year that require a restart, January, April, July and October, and eight hotpatch months that do not: February and March, May and June, August and September, November and December.

Whether that applies to you turns on the Windows edition, and this is where a lot of published advice goes wrong. Microsoft Learn states that hotpatching "is available for Windows 11 Enterprise, version 24H2 and later". Microsoft 365 Business Premium, the licence most Australian businesses of 10 to 300 staff run, grants Windows 11 Business upgrade rights, which is a Pro-based licence rather than Enterprise edition. Business Premium is listed among the licences eligible for hotpatch updates, which reads like a contradiction until you notice the edition requirement is a separate test. Devices that fail it are offered the standard latest cumulative update, which Microsoft notes "requires you to restart the device".

The practical position in 2026: if you are on Business Premium, Patch Tuesday still forces a restart most months, and that is your real baseline. If you are on Microsoft 365 E3 or E5 with Windows 11 Enterprise 24H2 or later and virtualisation-based security turned on, your devices may already be running eight months a year without a forced reboot, in which case the accumulated driver and memory state described above has far longer to build up and the deliberate weekly restart matters more than it did in 2019. The hotpatch quality updates report in Intune is the definitive answer for a given fleet. See Microsoft Learn on hotpatch with Windows quality updates.

What Blue Arc IT Solutions asks of staff

One thing: restart before you log a ticket, and tell us when you last did it. "Restarted twenty minutes ago and it still happens" removes an entire branch of the diagnostic tree. "Uptime is twenty-three days" tells us where to start. If you are not sure, our guide to checking how long since your PC was restarted shows how to find out in about fifteen seconds, including why the number Windows reports can be misleading.

Blue Arc IT Solutions has supported Australian businesses since 2004, delivering nationally from Canberra, and our latest client survey recorded 96 per cent satisfaction with response time, 94 per cent with resolution and 97 per cent overall. We set update and restart policy centrally through Microsoft Intune, so this is one of very few things we ask users to do themselves. See our managed services, the guide to sleeping, hibernating or shutting down a work laptop, or get in touch.

Last reviewed: 24 August 2026, against Microsoft Learn documentation on Fast Startup, Windows Update and hotpatch updates.

Frequently asked questions

Does shutting down a Windows PC count as a restart?

No. With Fast Startup enabled, which is the default on any PC capable of hibernation, a shutdown logs off all user sessions and then hibernates the kernel session to hiberfil.sys rather than closing it. Microsoft states that the Fast Startup setting does not apply to Restart, so a restart is the only one of the two that always performs a full boot cycle.

Will a shutdown install pending Windows updates?

Not reliably. Microsoft documents that installation of some Windows updates can be completed only when starting the computer after a full shutdown, and that because Fast Startup uses hibernation instead, you have to choose Restart from the Power menu to make sure pending updates are completed.

Should we disable Fast Startup?

Usually no. Microsoft states plainly that disabling Fast Startup is not recommended, and turning off hibernation to achieve it removes hibernate as well. A restart already gives you a full boot cycle, so there is rarely a reason to trade away the faster start.

Does restarting delete anything?

A restart clears the contents of memory but nothing that has been saved to disk. It does close every open application, so save your work first. Anything unsaved in an application that does not autosave will be lost.