@odessa thats true but only if the shutdown isn't done by a NTauthority
(kill the pid of services.exe and try)