First shutdown trace: NetTcpPortSharing, SMSvcHost.exe(2064) stand out

As most do I started this journey getting really annoyed as my shutdown and/or boot time kept creeping upward. I used to have a Commodore 128 (actually it lives on!) so I realize that 2 min may not be such a tragedy, but what I do know is that this machine used to shutdown much more quickly with basically the same software and hardware. So.... here's a link to the .zip and there's two screenshots of the services and driver delays graphs. These are just stabs in the dark but seem to standout a little. Hopefully some folks here can glean even more info out of the data.

My SevenForums dropbox folder

Also driver delays looked odd as it's basically 2 drivers causing ALL the problems. This is more likely a root cause. Thanks in advance. Really fascinating software I look forward to continuing a deeper dive into the data. And putting it to use!

I'm downloading the file now - it's slow from dropbox for some reason, but I should have it shortly. Getting lots of random disconnects today, and only to dropbox.

Not sure if that's my ISP, or dropbox.

I grabbed it from RDP elsewhere and put it on my skydrive, and downloaded it. I'm looking at it now, finally. DropBox is being throttled (as usual) by my ISP, as skydrive works fine (and others aren't having issues with DropBox on other ISPs that I contacted tonight).

Well, for starters something is taking a long time in the Network Policy Service (NPS) service during shutdown - I'll debug it in a bit, but it's almost 5 seconds of shutdown time just for that one thread in the dllhost that is spawned to interact with the NPS service. If you're not using it, disabling it might be a good choice (there's a lot of network activity and processes here, so I can't say for certain if what you're running it needs the service or not, but if so, that's part of your problem).

There's another 5 seconds (or so) in thread 4876 inside svchost 1052, and that wait time appears to superfetch-related. Given it's the sysmain svchost, it's not abnormal to see caching happening here, but the delays are hard to pin down as they go back to waiter threads and filesystem calls, which may also not be abnormal with antivirus installed, lots of disk activity due to shutdown, etc.

I don't seem to have that listing?! I did notice Netlogon was disabled and after reading the description I maybe shouldn't have?

This would be a good time to admit to some shady Services.msc activities. A noob with an itchy clicker finger.


Yes I see Superfetch in the events log often, causing problem.

Kaspersky can be a little intense sometimes resource wise. I did turn off the shutdown privacy cleaner, part of their Tools offerings. I had it on for a while and it (shutdown) never seemed to recover but that could just be coincidence.

Are you needing the NetTCP Port Sharing Service? It's not totally abnormal for NPS to be missing, but NTCPSharing is not normal, so I'm assuming you had reason to turn it on?

It does appear AVP is slowing down shutdown of services (in general) for almost 12 seconds from when winlogon gets the shutdown notification, so that's a problem. Then, there are the other issues I've found so far:

• Network shutdown takes a while, and NetGear Genie is apparently part of the problem (it makes an inordinate number of diskIO requests during shutdown, during the 0-9 seconds window from notification, and that cannot be helping as A/V unloads and superfetch is flushing it's cache
• Note as part of this delay, there's a delay in audiodg.exe hashing out the driver for "\Device\HarddiskVolume2\Windows\System32\ViaKaraokeApo.dll", which delays playing the shutdown sound, which actually delays shutdown for a little over 1.5 seconds or so. Not critical, but probably a crap driver.
• After almost 9 seconds, Winlogon can finally unload the user and is likely to have placed you at the logonui screen (rather than the desktop). Windows Update stops here, approximately .67 seconds, then the rest of the services are allowed to stop. If we exclude the IIS services (why are these here???), AVP, and NetTCP port sharing, it's just over a second to stop services.
• However, if we add back IIS, AVP, and the NetTCP Port Sharing, it's an additional 6.57 seconds AFTER THAT to shut down (which gives the ultimate time of around 20 seconds).

I'd update your driver set in general, but especially your network drivers. Second, remove any unnecessary pieces of networking software (like that NetGear Genie package, at the very least - I'd even attack IIS and your antivirus too and see if something else can accomplish what that is doing), and look at disabling services like NetTCP Port Sharing, NetPipe and NetTCPActivator, PolicyAgent, and things like Secunia.

Only once you've gotten things stable (even if that means removing certain things) can you consider putting things back (carefully, and with thorough perf traces to gauge impact) to get back to a state you might need.

The thing you have to remember is, if you really *do* need all that stuff you have installed, you might have to accept slower shutdown times (although this bad seems excessive, it's not totally uncommon).