How to detect whether Windows is shutting down or restarting

In Windows 7 (and probably also in Vista / 8 / Server) you could use the system events to track whether Windows is shutting down (and powering off the computer) or just restarting. Every time a shutdown/reboot is initiated (by any means – clicking the button in Start menu, or programmatically), Windows 7 writes one or two events in the System log, source USER32, event ID 1074. You can see these events recorded if you open the Event Viewer from Administrative Tools (filter the System log to see only ID 1074). The description (message) of these events contains the shutdown type. So you could parse the description of the most recent event of this type (after the shutdown was initiated), looking for the necessary word (shutdown, reboot/restart).

I didn’t try to see the shutdown type written in the event when using the power button to gracefully shutdown Windows (I usually disable this function), but some site suggests that it states a “power off” type instead of “shutdown” – so check it out, if you need to be sure. Or simply look for a “reboot” type – if it’s not found, then a “shutdown” type is assumed.

In Windows XP, from my experience, an event 1074 is recorded only if the shutdown/reboot is done programmatically (e.g. during a program install or using the shutdown.exe utility). So it does not register the shutdowns initiated from the shell (Explorer), but perhaps you could combine this method with reading the value from registry as proposed in another answer. Also, keep in mind that in WinXP the message of event 1074 contains the word “restart” no matter what the real type of shutdown is, so you should look at the “Shutdown Type:” field, which will state either “shutdown” or “reboot”.

Related to this, an event ID 1073 is recorded whenever Windows fails to shutdown/reboot for some reason (e.g. if an application doesn’t allow to shutdown as a response to WM_QUERYENDSESSION). In that case the message will also contain words as “shutdown”, “reboot” or “power off” – in WinXP. For Win7 this type of event is less useful in our case, since it won’t make any difference between shutdown and reboot. But for WinXP – if you only need to intercept the shutdown/reboot, perform some actions, then continue the corresponding shutdown or reboot process – it should work as expected.

Leave a Comment