Windows Fast Startup: Why IT Often Turns It Off

Press Shut down on a Windows PC and, by default, it does not fully shut down. It hibernates the kernel and closes the user session, which explains stale uptime counters, restarts that fix what shutdowns do not, and Wake-on-LAN that never fires. This guide covers what Windows Fast Startup does, where it causes trouble on a managed fleet, and how to turn it off at scale.

What Windows Fast Startup Does

Fast Startup is a hybrid between a shutdown and hibernation. Microsoft describes the mechanism like this: all user sessions are logged off, then the kernel session and device drivers are saved to hiberfil.sys instead of being closed. On the next power-on, Windows loads that saved state instead of building it from scratch.

The same page notes that Fast Startup is enabled by default. You will also see it called hybrid shutdown or hybrid boot. Fast Boot in a PC's BIOS or UEFI menu is a separate firmware setting, so changing one does not change the other.

Apps start clean because the session is closed. The kernel and its drivers do not, because they resume from disk. A shutdown followed by a power-on is not a fresh start.

Fast Startup vs Hibernate and Sleep

Three low-power paths get confused, and the difference matters for remote management. Sleep keeps the session in RAM and is the state Wake-on-LAN works from by default. Hibernate writes the whole session to disk, including open apps. Fast Startup writes only the kernel and drivers, after the user session is closed.

Microsoft's Wake on LAN article points out that the target power state of a hybrid shutdown and a hibernate is the same (S4). Windows only disarms the network adapter on the hybrid transition, though, so an explicit hibernate can still be woken where a Shut down cannot. That detail is why "just hibernate the PCs at night" is a workable stopgap while you plan the policy change.

Shutdown Is Not Restart

The Fast Startup setting does not apply to Restart. A restart runs a full boot cycle, because someone who restarts usually wants a completely new Windows state, such as after installing a driver. The command line draws the same line: shutdown /s /t 0 is a full shutdown, and shutdown /s /hybrid /t 0 opts in to the hybrid one, as the shutdown command reference lists.

Users do not know this, and the helpdesk feels it. A sysadmin in this r/sysadmin thread from March 2024 watched a user choose Shut down three times with no change in the problem or the uptime. Only Restart changed both, and the poster says users keep shutting down when told to restart.

Where Fast Startup Causes Trouble

Four problems share one root: the kernel state survives a shutdown.

• Wake-on-LAN. Microsoft's Wake on LAN article says Windows does not arm network adapters for WOL on a hybrid shutdown, so WOL works from sleep or an explicit hibernate. It describes this for Windows 10.
• Uptime reports. The counter follows the kernel session, so a PC shut down every night can still report weeks of uptime. Reports that flag machines by days since last boot point at the wrong ones.
• Driver and state fixes. A new driver or a cleared fault lands on Restart. A shutdown resumes the saved state.
• Failed shutdowns. Microsoft documents a case where shutdown or hibernate fails and returns to the lock screen when the memory dump driver does not load (Event ID 45, and a bad DumpFilters value).

The first two hit after-hours patching hardest, because Wake-on-LAN and boot-age reporting both sit under it. Our Wake-on-LAN guide covers the firmware, driver and subnet side of that fix. One admin in the thread above calls Fast Startup the root cause of a significant number of issues they see, which matches the pattern.

If shutdowns end up logged as crashes, read the Event ID 6008 guide next.

How to Check Whether Fast Startup Is On

The setting lives in Control Panel under Power Options, Choose what the power buttons do. For a fleet, read the registry value instead. 1 means on, 0 means off, and a missing value usually means hibernation is unavailable.

powershell
$p = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power'
(Get-ItemProperty -Path $p -Name HiberbootEnabled -ErrorAction SilentlyContinue).HiberbootEnabled

# Days since the last full boot
((Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime).Days

Any tool that runs a script across a client's devices and collects the output can run this audit, and OpenFrame does. Sort the results by value and by boot age. PCs with a value of 1 and a boot age over 30 days are the first suspects, because their users are shutting down and believing the machine was reset. Pick your pilot group from that list, and include at least one PC that you wake remotely.

How to Turn Fast Startup Off Across a Fleet

Three routes, in order of preference:

1. Group Policy. Under Computer Configuration, Administrative Templates, System, Shutdown, set Require use of fast startup to Disabled. Our Group Policy guide covers where it applies and why it sometimes does not.
2. Registry script. Set HiberbootEnabled to 0 under the Power key above. This suits devices outside a domain and anything you push from an RMM.
3. powercfg /h off. This turns hibernation off, which removes the file Fast Startup needs. It also removes hibernate itself, so keep it for desktops and virtual machines.

Microsoft's own pages say it does not recommend disabling Fast Startup, so pilot first. Shut down, power on, then test Wake-on-LAN and read the uptime. Roll out only after both behave, and write down the result so the next technician knows why the policy exists.

When to Leave Fast Startup On

Fast Startup is not wrong, it is a default aimed at one PC owned by one person. Microsoft keeps it on for that reason. Older machines with spinning disks gain the most from skipping the kernel rebuild, and unmanaged home PCs have no Wake-on-LAN or uptime report to break.

On a managed fleet the trade changes. In this r/sysadmin thread a school admin with 20 shared laptops, roaming profiles and folder redirection asks whether to keep it.

If you keep it on, schedule a weekly Restart for patch cycles so the kernel resets on a timer, not when the user remembers. This short video from Hands-On Tech walks through the shutdown versus restart difference for end users:

Fast Startup, in Short

Shut down saves the kernel and Restart resets it. Fleets that rely on Wake-on-LAN, boot-age reports or predictable resets are better off with Fast Startup disabled by policy after a pilot. Anywhere else, keep the default and make Restart the habit.