Former Microsoft engineer explains the old 'super-fast' Windows restart trick: interesting but full of bugs.

If you've been a long-time Windows user, you've probably noticed a rather strange phenomenon: holding down the Shift key when restarting Windows doesn't create a complete 'cold' reboot; instead, the system handles it in a somewhat unusual way.

 

For those unfamiliar, holding down the Shift key while restarting Windows 95 didn't reset the entire hardware as usual. Instead, Windows displayed the message 'Windows is restarting' and attempted a quick restart. In a sense, this mechanism is quite similar to Fast Startup – a feature Microsoft didn't officially introduce until Windows 8. Today, trying Shift + Restart on Windows 10 or 11 will take you directly to the Windows Recovery Environment (WinRE).

Veteran Microsoft programmer Raymond Chen recently explained this mechanism in detail in a blog post on The Old New Thing . According to Chen, the behavior stems from the 16-bit ExitWindows function when it receives the EW_RESARTWINDOWS parameter.

Essentially, ExitWindows is an old function used to log out Windows users, while the EW_RESARTWINDOWS parameter – as the name suggests – requests a system restart. When enabled, the shutdown sequence begins with the 16-bit Windows kernel, followed by the 32-bit virtual memory manager, and finally the CPU returns to real mode.

After this step, control is returned to the win.com startup program, accompanied by a special signal that can be roughly translated as: 'Could you please restart Windows in protected mode for me?' . Upon receiving this request, win.com will display the message 'Please wait while Windows restarts…' and attempt to restart Windows without rebooting the entire system.

 

What are Win.com, real mode, and protected mode?

Chen further explained that win.com is the executable file used to load versions of Windows running on DOS, such as Windows 95. Meanwhile, real Windows mode was a very early design, aimed at PCs with extremely low specifications, only about 192 KB of RAM and using floppy disks. Conversely, protected Windows mode was the 'full Windows,' with memory protection, a graphical interface, and more modern features.

By design, .com files occupy all normal memory upon launch. However, win.com has a unique feature: it frees up unnecessary memory to create a sufficiently large, continuous memory block for Windows protected mode. If this memory is not fragmented, the fast reboot process will be successful. But if another program previously fragmented the memory, win.com will be forced to revert to a full reboot.

Under favorable circumstances, win.com will recreate the virtual machine manager, launch the graphical interface, and give the user the feeling that Windows has just undergone a 'flash restart'.

Interesting, but far from perfect.

Despite being clever and ahead of its time, this mechanism is not entirely stable. Raymond Chen stated that some users reported that performing two consecutive fast restarts could cause the system to crash, while others were able to use it multiple times without problems.

The most likely cause lies with the device driver. Some drivers are not reset properly, leaving corrupted memory, and the problem only becomes apparent during the shutdown process. This is also why Microsoft is gradually eliminating these kinds of hidden "tricks" as Windows increasingly focuses on stability, security, and greater control.