title: Find out when shutdown -s is being executed
body: <p>I have a main computer that knows when there is a power outage. That main computer will then tell all workstations to shutdown over the network using the built in "shutdown /m \computername /s" command. 
  That main computer will also tell individual workstations to restart using the same <code>shutdown /m \\computername /r</code> mechanism.</p>
  
  <p>Each workstation has a script that when executed, saves all the important data.</p>
  
  <p>Each workstation has to execute its script when being told to shutdown or restart over the network (<code>shutdown /m \\computername /s</code> or <code>shutdown /m \\computername /r</code>). </p>
  
  <p>Idea1:</p>
  
  <ul>
  <li>Use the WM_QUERYENDSESSION event to find out when a shutdown/restart occurs.</li>
  <li>Cancel the shutdown/restart.</li>
  <li>Run the script.</li>
  <li>Continue shutdown/restart (<strong>Problem</strong>: I don't see a reasonable way to determine if a shutdown or a restart has been issued by the main computer.)</li>
  </ul>
  
  <p>Idea2: </p>
  
  <ul>
  <li>Wait until the shutdown.exe process exists.</li>
  <li>Retrieve the command line parameters of that process</li>
  <li>Kill that process</li>
  <li>Run the script.</li>
  <li>Run shutdown.exe with the retrieved parameters.</li>
  </ul>
  
  <p><strong>Problem</strong>: shutdown.exe isn't actually getting executed. Not even if you locally run a simple <code>shutdown -s -t 30</code>.  </p>
  
  <p>Idea3:</p>
  
  <ul>
  <li>Sniff incoming network traffic.</li>
  <li>Look for shutdown -m packets</li>
  <li>...</li>
  </ul>
  
  <p><strong>Problem</strong>: I have no idea what protocol is being used and how the packets are formatted.</p>
  
  <p>Idea4: </p>
  
  <ul>
  <li>Monitor event logs</li>
  <li>Hope that it contains informations about what kind of shutdown has been issued</li>
  </ul>
  
  <p><strong>Problem</strong>: I have no idea if and where this would be logged.</p>
  
  <p>PS:<br>
  I don't want to use PsExec. The workstations have to execute their scripts on their own.</p>