If a cluster stops gracefully, no failover is initiated. Only if a cluster is detected as faulted by the surviving cluster, a failover happens.

When a system is shut down, windows attempts to stop all the services, thus HAD gets a chance to offline the service groups and gracefully transit from LEAVING to EXITING and then EXITING to EXITED. This is not treated as a disaster, but an intentional administrative offline.

A graceful shut down can potentially fault if engine does not get chance to transit to EXITED state. Windows will forcibly kill HAD if it takes too long to complete its housekeeping. A graceful shut down at times can trigger global failover if engine times out.