trying to debug slow shutdown

I'm trying to debug a slow shutdown on my laptop with an SSD.

I've done the msconfig to so non-microsoft services and other startups do not start at boot but this doesn't make a big difference.

One thing is that although the shutdown takes 2 minutes, and the disk activity light is pinned solid in those 2 minutes, so something is going on, I can't seem to figure out how to get information about what is going on. The big problem is that 7 seconds after the shutdown command, the event log service shuts down. After that point there are no log entries.

Is there a way to configure the event log service so that it doesn't stop right after the shutdown command? If there were log entries this would probably be quick debugging.

Also while I am at it, here are my theories for what is going on (1) the disk is busy in those 2 minutes doing some sort of registry backup, or (2) also running through a journaling file system log to update disk blocks to a consistent state, or (3) or running the search indexer.

What does Windows 7 do to the disks when it is shutting down?

There's boatloads of stuff on my machine (Dynamics, Adobe Creative Suite, ...)
Now that you've got me thinking about it, Dynamics runs a local version of SQL server.
That would be just the ticket for something that wants to do a lot of IO before it closes down.
That would show up in the Event Log if I could get the Event Logger to stay alive longer.
But I could try disabling that service.

Thinking about it I suspect this might be due to VSS, the shadow copy. In fact SQL server has some sort of service that does a VSS backup of the database. Hard to confirm though without event log staying alive.

Putting the pagefile on the SSD is exactly what the SSD ought to be good at, especially for Windows, where bloated applications like Outlook spend most of their time crushing the IO system with page faults. That is why SSDs make such a big difference in the performance of running Outlook. So it makes no sense to move it off. Clearing the page file on a mechanical disk will be even that much slower.

A question on the ClearPageFileAtShutdown flag. I'd imagine that a danger of this would be that the disk would be that much more vulnerable to cracking with latent passwords, etc. sitting in the clear on the disk from poorly written applications. But is there any other downside? I was experimenting with this flag yesterday -- it did seem to make the shut down faster but then I had trouble rebooting - to the extent that for a moment it looked like I was going to have to do a full system restore from backup disks in order to get my computer back. Luckily it did come back and I quickly changed the flag back, but maybe this was coincidental.

Also if one is running full disk encryption such as bitlocker or PGP whole disk encryption, the clearing of the page file would be relatively pointless, right?