Windows – detecting if a Windows shutdown command has been issued

shutdownwindowswindows 7windows xpwindows-explorer

Is it possible to detect if the shutdown command has been issued (through the start menu by the user, or any other program running on the computer or having remote access to the computer), then cancel it ?
Alternatively, is it possible to tweak the registry to force Windows to display a shutdown timer whenever the shutdown command gets issued, so that we get some to get it disabled?

Best Answer

  • Yes and (mostly) no.

    You can detect a shutdown event. When Windows is about to shut down, it sends a WM_QueryEndSession to all open applications. To detect this, you would have to have a script or program running in the background to detect and handle the event. However, there doesn't seem to be any way to cancel the shutdown, unless the shutdown was initiated from the local machine and user.

    The script/app could then catch the shutdown even and ask you if you want to quit the script/app, in which you can then cancel. This will prevent the machine from shutting down, but it won't prevent other apps and possibly services from being terminated.

    You don't even need a script for this, you could just open notepad and type in some text. Since you have unsaved data in Notepad, Windows will wait and ask if you want to continue the shutdown, giving you the opportunity to cancel. Again, this will only work if you initiated the shutdown locally.

    There is a WMI Win32_ComputerShutdownEvent event, which occurs when a computer gets shutdown via a remote command. However, it can only receive this event. When the event is received, the local computer will terminate the script when the event is delivered.

  • Related Question