Does he have a hard drive (or attached external device) set to write-behind for speed? If so, then it's just trying to catch up before shutting down. Without knowing anything about his machine, all of this is guesswork. I would suggest the following (all can be done for free from an Administrator account):
Run Malwarebytes to make sure there's nothing else going on
Run Glary Utilities to clean up the system and remove unneeded temporary files
From Glary, you can perform a defrag analysis and defrag if needed
Also from Glary, you can see what else starts when he boots
Is the computer up-to-date? Maybe Windows (or Java, or Adobe, etc.) is repeatedly trying to check for updates (you can disable some from Glary too).
Does it say what application it's waiting for during the shut down?