Shutting down Macs running 10.13

[AVmcclint]

Ever since I've started upgrading Macs running High Sierra, I have noticed that each and every one of them is extremely reluctant to shut down or restart. I get as far as the black screen with the spinning gear and that's it. I end up forcing the computer to power off after several minutes. In some cases I've let it sit there for an hour and a half and the computers never shut off. This is causing serious issues with laptops because users throw them in their bag and go home in this state. Meanwhile the computer is still "Running" and the fans spin up and the battery drains. Has anyone else seen this problem since upgrading to High Sierra? These are all in-place upgrades from 10.12.6 to 10.13.1, 10.13.4, or 10.13.6 (I've been seeing this problem for a long time)

[jhalvorson]

Note the time you issued the shut down. After it has shut down, power on, login and look in the Console app > System Reports folder or system.log for events after the shut down timestamp. You might see repeating messages the indicate something along the lines of a agent or app not able to be exited, closed, or shutdown.

[AVmcclint]

I checked system.log and System Reports, but every looks normal from what I can tell. Here is one I managed to capture this morning.

Shutdown was initiated at this point

Sep 26 08:06:56 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.bsd.dirhelper[2767]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.bsd.dirhelper
Sep 26 08:06:56 C02ML6FMFD57 Finder[1567]: libcoreservices: __create_or_fix_relative_directory: 959: __dirhelper_create_relative returned (os/kern) failure
Sep 26 08:06:56 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.quicklook[2768]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook
Sep 26 08:06:56 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Sep 26 08:07:22 C02ML6FMFD57 systemstats[59]: assertion failed: 17G65: systemstats + 914800 [D1E75C38-62CE-3D77-9ED3-5F6D38EF0676]: 0x40
Sep 26 08:07:25 C02ML6FMFD57 Finder[1567]: BUG in libdispatch client: kevent[mach_recv] monitored resource vanished before the source cancel handler was invoked
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.screensharing.menuextra[1259]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.universalaccessAuthWarn[1649]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.wifi.WiFiAgent[1247]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.talagent[1294]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100009.Aqua): Caller not allowed to perform action: loginwindow.113, action = service removal, code = 150: Operation not permitted while System Integrity Protection is engaged, uid = 0, euid = 501, gid = 20, egid = 20, asid = 100009
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.TMHelperAgent.SetupOffer[2766]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.noticeboard.agent[1619]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.AirPlayUIAgent[1616]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.cloudphotosd[1257]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.SystemUIServer.agent[1566]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.imklaunchagent[1610]): Service exited due to signal: Terminated: 15 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.coreservices.uiagent[1289]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.ViewBridgeAuxiliary[1344]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 iTunesHelper[1629]: exiting due to SIGTERM
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.universalaccessd[1097]): Service exited due to signal: Killed: 9 sent by loginwindow[113]
Sep 26 08:07:25 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.iTunesHelper.1564[1629]): Service exited with abnormal code: 1
Sep 26 08:07:25 C02ML6FMFD57 McAfee Reporter[1614]: Application is teminating
Sep 26 08:07:25 C02ML6FMFD57 systemstats[59]: assertion failed: 17G65: systemstats + 914800 [D1E75C38-62CE-3D77-9ED3-5F6D38EF0676]: 0x40
Sep 26 08:07:30 --- last message repeated 4 times ---
Sep 26 08:07:30 C02ML6FMFD57 sessionlogoutd[2873]: DEAD_PROCESS: 113 console
Sep 26 08:07:31 C02ML6FMFD57 efilogin-helper[2907]: objc[2907]: Class EFILWLogging is implemented in both /System/Library/PrivateFrameworks/EFILogin.framework/Versions/A/EFILogin (0x7fff917dd088) and /System/Library/PrivateFrameworks/EFILogin.framework/Resources/efilogin-helper (0x10a004ce8). One of the two will be used. Which one is undefined.
Sep 26 08:07:31 C02ML6FMFD57 efilogin-helper[2907]: objc[2907]: Class EFILWLogging is implemented in both /System/Library/PrivateFrameworks/EFILogin.framework/Versions/A/EFILogin (0x7fff917dd088) and /System/Library/PrivateFrameworks/EFILogin.framework/Resources/EFIResourceBuilder.bundle/Contents/MacOS/EFIResourceBuilder (0x10a0943b0). One of the two will be used. Which one is undefined.
Sep 26 08:07:33 C02ML6FMFD57 secd[2942]: objc[2942]: Class SecSOSStatus is implemented in both /System/Library/Frameworks/Security.framework/Versions/A/Security (0x7fff900abd78) and /usr/libexec/secd (0x10e57d850). One of the two will be used. Which one is undefined.
Sep 26 08:07:33 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.quicklook[2948]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook
Sep 26 08:07:38 C02ML6FMFD57 shutdown[3034]: SHUTDOWN_TIME: 1537963658 413033
Sep 26 08:07:38 C02ML6FMFD57 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system): System shutdown initiated by: shutdown.3034<-sessionlogoutd.2873<-launchd.1
----------this is where I forced the computer to power off and booted it back up again----------
Sep 26 08:19:38 localhost bootlog[0]: BOOT_TIME 1537964378 0
Sep 26 08:19:40 localhost syslogd[52]: Configuration Notice:
    ASL Module "com.apple.cdscheduler" claims selected messages.

[AVmcclint · Accepted solution]

Followup: it turns out that the culprit was a misconfigured ECAT agent that was rolled out around the same time we started upgrading to High Sierra. Once our ECAT admin pushed the proper ECAT config out, everything went back to normal.