1. To check if a particular program is slowing the machine when you shut down, e.g. an antivirus program, go to Control Panel > Classic View > Performance Information and Tools > Advanced Tools (in the left pane). On this screen the problem is sometimes shown.
2. If it isn’t shown, click the Windows Orb (Start) > All Programs > Accessories, right-click Command Prompt then ‘Run as Administrator’. Copy & Paste or type wevtutil qe Microsoft-Windows-Diagnostics-Performance/Operational /f:text > %userprofile%\Desktop\Event.txt (note the five spaces) and press Enter. If you Copy & Paste the command, use mouse right-click to Paste it into the prompt.
Close the command prompt and double-click Event.txt on the Desktop to open it. Go to the end of the file (Ctrl+End) to see the most recent events. Those with an Event ID in the 200 series are shut down events.