OK, here goes. First, you need to
download the Windows 7 SDK, and then run the SDK installer to download the Windows Performance Toolkit (WPT) redistributable files. Ignoring the fact that my system has the Debugging tools installed and thus "checked" in the "Common Utilities" node, you only need to check the "Windows Performance Tookit" box under the "Redistributable Packages" section, as shown below:
After you click next, it will download (only) the installation .MSI packages needed to actually install the WPT. Once the download of the files is complete and you exit the SDK installer, you will need to actually install the version of the WPT that matches the architecture of your OS (the x86 MSI on a 32bit Win7 machine, the x64 MSI on a 64bit Win7 machine). The downloaded .MSI files will be located (by default) in C:\Program Files\Microsoft SDKs\Windows\v7.1\Redist\Windows Performance Toolkit:
Install the correct .MSI that matches the architecture (32bit or 64bit) of your Windows 7 install, taking all the default options and performing a "Complete" installation.
Last, you need to execute this command in an
ELEVATED (Start > type "cmd", right-click the "cmd" icon from the list and select "Run as Administrator") cmd prompt to create a shutdown trace:
Note that this command is
*all one line*, so watch out for any sort of word wrap if you are copying/pasting from your browser:
Code:
xbootmgr -trace shutdown -traceFlags BASE+LATENCY+DISK_IO_INIT+DISPATCHER+DRIVERS+FILE_IO+FILE_IO_INIT+NETWORKTRACE+PERF_COUNTER+POWER+PRIORITY+REGISTRY -stackWalk CSwitch+DiskFlushInit+DiskReadInit+DiskWriteInit+Mark+ProcessCreate+ProcessDelete+Profile+ReadyThread+RegCloseKey+RegDeleteKey+RegDeleteValue+RegSetValue+SyscallEnter+SyscallExit -resultPath "C:\Shutdown_Trace"
That command will cause your machine to reboot. Once you log back in, you'll see a short (2 minute) delay, and then your machine will reboot *again*:
Once the machine has rebooted this time, you will be able to log on and the tool will then merge the kernel mode and user mode portions of the trace into one (very) large .etl file in C:\Shutdown_Trace (or if you changed the location folder, the location you specified):
This .etl file needs to be compressed (7zip, WinRar, WinZip, etc) before you will be uploading it. Let me know if/when you are able to get to this point, and I will PM you a location that it can be uploaded securely.