windows-internals

Why your NumLock “fix” keeps coming back: Fast Startup's hibernation replay

Fast Startup hibernates kernel sessions, not your fixes. How partial hibernation changes which settings 'take' at boot, which don't, and how to test permanently.

ProofTune Project··4 min read
Windows internals illustration Windows internals

Fast Startup, genuinely

Fast Startup (hybrid boot) writes the kernel and session-zero state to hiberfil.sys at shutdown. On power-on, that image resumes; user sessions are logged off, so per-user settings re-load — but anything kernel-side (driver state including some keyboard controllers) comes back cross-fade from the hibernated snapshot.

Why this corrupts testing

Edit key → Shut down → Power on
kernel state resumes from image — your edit didn't get a chance to drive the boot path
Edit key → Restart
full boot path: kernel re-init, drivers re-load, settings re-read

That's the whole “it worked until I shut down” genre: Restart bypasses Fast Startup; Shut down doesn't.

Proof discipline

  • Test with Restart, not power cycles, when validating any boot-adjacent tweak.
  • On desktops where hibernation is admin-controlled, note you're editing the one boot-path the user can't reach with a per-user tool — document the behavior instead of fighting it.
  • Audit HKCU values after a real restart before concluding anything won’t stick; most “reverts” are replayed hibernation state, not rollback.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.
ProofTune logo

See these exact settings inside the real tool

The browser replica runs the same strings and states as the installed app — click around before you ever install anything.