In Windows 7 script, how can I determine if current system shutdown is actually a reboot?

Question

I use the Group Policy Editor which is part of Windows 7 (also of Windows XP) to run a so-called shutdown script, which will automatically be executed each time the system is shutdown or rebooted. My problem is: I need to know in my script if the user has selected to shutdown the system, or if he has selected reboot instead. Both actions will make Windows run the shutdown script, but how can I determine during that script execution which action was actually performed?

Is there any way to know, during shutdown, if the system currently performs a shutdown or a reboot?

Demob

Answer 1

On pre-vista systems you can query the Registry:

The Shutdown Setting DWORD found under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer stores the setting selected most recently from the list on the Shut Down Windows dialog box for the current user.

On more recent systems, you can query the System Eventlog in your shutdown script, like this:

$systemstateentry = get-eventlog -LogName system -Source User32 | ?{$_.eventid -eq 1074} | select -first 1

switch -regex ($systemstateentry.message) 
    { 
        ".*restart.*" {"restart"} 
        ".*power off.*" {"power off"} 
        default {"unknown"}
    }

Likable

Thanks a lot, is this also true if the shutdown or reboot was done programatically, or via commandline, like if you run "shutdown.exe -r" or "shutdown.exe -s" from the cmd-Window? I really would like to recognize shutdown or reboot, no matter how it was initiated. – Demob

Addition to my previous answer: unfortunately, this value is not existing on any of my Windows 7 systems, and it is also not present during shutdown, I wrote a little VB Script checking for that value during shutdown/reboot, but the registry value is simply not present. Can you please check if this value is present on your Win7 machine? Is this information still true for Win7 at all? – Demob

Updated the answer for Windows Vista/7 – Likable