Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is this possible without having a process running continuously, listening for WM_QUERYENDSESSION or similar? (or worse still, loading a DLL into the Winlogon process)

(Also unacceptable: write a script / program that does what you want, then logs off, and require the user to only use this program to log off, rather than Start -> Log Off or various other normal methods)

It's easy on XP Pro with Group Policy but I don't think that works on XP Home even if you "install" the group policy editor.

share|improve this question
Have you tried out with installing GPEDIT on XP Home? If not then give a try to it. – avirk May 16 '12 at 1:23
See velocityreviews and this. May be they will helpful for you. – avirk May 16 '12 at 1:35

I believe that this Stack Overflow question may be your best bet:

This thread also goes into more options in more detail:

The basic approaches are to either use WMI to listen for or hook Win32_ComputerShutdownEvent or to have something running (possibly hidden) that Windows will send a shutdown message to, written in something that lets you trap the reason for closing.

share|improve this answer
But I specifically said I didn't want to keep a process running. – Hugh Allen May 18 '12 at 12:49
Well, I'm not sure if you can set up a hook that will launch an executable, but I doubt it. Since it seems that some variation of this is available in XP Pro and nobody's come up with an XP Home solution that doesn't require a process in the past 10+ years, it seems to me that your options include A) change OS or B) have something running. Expecting innovation for a sunsetted consumer product seems unpromising. – fencepost May 18 '12 at 18:04
I realize it's a difficult question. That's why I put a bounty on it :) – Hugh Allen May 18 '12 at 23:17

The Windows Task Scheduler has a trigger "On disconnect from user session".

I don't remember if the feature was available on Windows XP home though. If not you might find a good event-log entry to trigger the task instead (some service stopping for example).

share|improve this answer
"On disconnect from user session" isn't even available on XP Pro. I'll investigate event triggers. – Hugh Allen May 23 '12 at 1:15
It was a good idea, but unfortunately eventtriggers.exe is not present on XP home, and doesn't work if you copy it across. – Hugh Allen May 25 '12 at 16:57
It's quite a hack, but you could try replacing C:\Windows\system32\shutdown.exe with your executable which will call the original in sequence with identical commandline... kind of tricky but I'm also scraping the bottom of "the hat of tricks" by now... – Louis Somers May 25 '12 at 22:58
Are you implying that all logoffs / shutdowns go via shutdown.exe? – Hugh Allen May 26 '12 at 16:40
I'm not 100% sure, I assume. (I know that's dangerous) But it would not surprise me (30K is not nothing) – Louis Somers May 26 '12 at 17:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.