Troubleshooting Event 1073: The attempt to power off %pc% failed

Once in a lifetime, you may encounter a problem on Windows XP that you cannot log off or shutdown your computer. You may click on Log off <user> or Shutdown… but eventually nothing happens.

The following errors typically then show up in your eventlog:

Event Type:       Warning
Event Source:     USER32
Event Category:  None
Event ID:          1073
User:                 NT AUTHORITY\SYSTEM
Description:        The attempt to power off %pc% failed

If you want to solve this issue, there’s a good and a bad point.
The good point is: we can be sure there is a process running on the pc that prevents you from logging off.
The bad point: we can’t easily find out what process

I have done some research with Sysinternal tools in the past, but came back with nothing. The best advice I can give you:  Open the Task Manager, and try to end all processes, one by one, followed by trying to log off. Yes: it’s a hell of a job if you have 50 processes running, but as far as I found out, it’s the _only_ way. (please comment of you have an alternative 🙂 ).

In my case, it was the process ctfmon.exe on a specific computer with a very specific configuration.
CTFMON.exe is often used by Office, with it also used by Windows to enable Asian languages. However, if you do not need the support for Asian character, you can turn off CTFMON.exe by turning off the advanced text services. To do so:

  1. Click Regional and Languages Options from the Control Panel
  2. In the Regional and Languages Options window, go to the tab Languages, and click Details
  3. In the Text Services and Input Languages window, check the option Turn off advanced text services


What this setting underwater does:

  • It removes the execution of CTFMON from HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
  • It sets the Disabled Thread Input Manager to 1 (REG_DWORD) in HKEY_CURRENT_USER\Software\Microsoft\CTFclip_image002[14]

One more note for those who want every user to have this setting disabled: you can off course do this via Group Policy (Preferences), but you can also use Active Setup. With Active Setup, you basically configure every user’s profile as they logon to the machine. This practice is not intended for a bunch of computers, because you need to set it up for every computer individually. However, if you need to set it up on just 1 pc, you’ll be fine.

Open Notepad, copy-paste the following text in it, save the file as a reg-file (*.reg) and execute it on the pc where you want to disable CTFMON:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DisableATS]
"StubPath"="REG ADD HKCU\\SOFTWARE\\Microsoft\\CTF /v \"Disable Thread Input Manager\" /t REG_DWORD /d 1 /f"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DisableCTFMON]
"StubPath"="REG DELETE HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v ctfmon.exe /f"

0 0 votes
Article Rating
Notify of
Newest Most Voted
Inline Feedbacks
View all comments

Great tip: systematically ending each program until the pending occurs reboot. Using this method, I was able track down the offending application process.

jacksonville fl computer forensics

After checking out a handful of the blog posts on your web page, I truly like your technique
of blogging. I book marked it to my bookmark webpage list and
will be checking back soon. Please check out
my website as well and let me know how you feel.

Would love your thoughts, please comment.x