Is it possible to detect if the shutdown command has been issued (through the start menu by the user, or any other program running on the computer or having remote access to the computer), then cancel it ?
Alternatively, is it possible to tweak the registry to force Windows to display a shutdown timer whenever the shutdown command gets issued, so that we get some to get it disabled?


Yes and (mostly) no.

You can detect a shutdown event. When Windows is about to shut down, it sends a WM_QueryEndSession to all open applications. To detect this, you would have to have a script or program running in the background to detect and handle the event. However, there doesn't seem to be any way to cancel the shutdown, unless the shutdown was initiated from the local machine and user.

The script/app could then catch the shutdown even and ask you if you want to quit the script/app, in which you can then cancel. This will prevent the machine from shutting down, but it won't prevent other apps and possibly services from being terminated.

You don't even need a script for this, you could just open notepad and type in some text. Since you have unsaved data in Notepad, Windows will wait and ask if you want to continue the shutdown, giving you the opportunity to cancel. Again, this will only work if you initiated the shutdown locally.

There is a WMI Win32_ComputerShutdownEvent event, which occurs when a computer gets shutdown via a remote command. However, it can only receive this event. When the event is received, the local computer will terminate the script when the event is delivered.

  • to start sending the events, the OS probably needs to get a request to shutdown first, so isn't it possible to force windows to display a timer whenever such a request is detected? While this timer is counting the user can then issue shutdown /a. The user also has admin privileges so this should not be a problem – user13267 May 2 '13 at 5:37
  • I understand that this would also show a timer when I shutdown from the start menu, but that's ok – user13267 May 2 '13 at 5:42
  • You are really grasping at straws here. Once the shutdown is initiated - and NOT by you, the shutdown will happen. It will terminate any applications and scripts. – Keltari May 2 '13 at 5:51
  • Could the script execute shutdown -a and abort the shutdown? – Vinayak Apr 18 '16 at 21:42

This is for Windows 7 (in corporate environment): If an admin triggered a remote shutdown (shutdown /m PCName) windows 7 should display a notice saying that the PC is getting instruction to shutdown / restart and give you the countdown.

The user sitting on the PC CAN cancel it, assuming that the user also have admin right on the machine by running:

shutdown /a

to abort any existing shutdown in progress.

But of course this point is moot if the admin put a timer for 1 second, or immediate shutdown.

Windows 8 - You get a notification at the System Tray (when the shutdown is issued) that windows is about to shutdown in xxx minutes, and shutdown will happen at xxx time/date. And I believe at 1 minute to shutdown, Windows 8 will display a full screen notification that you will be shutdown in 60 seconds, and you actually have to click on close to confirm the message.

Windows XP - I believe it will display the timer as well, but I can't confirm as I don't have WinXP machine to test.

Again, you can cancel all 'scheduled' shutdown by the command above, but if you run out of time, not much you can do.

  • 1
    This will not stop a shutdown. This will only stop the timer to the shutdown. Once the timer is up, and the shutdown has been initiated remotely, there is no way to stop it. You are also assuming the shutdown command had a timer to begin with. Most remote shutdown commands are immediate. – Keltari May 2 '13 at 5:19
  • technet.microsoft.com/en-us/library/cc725878.aspx this says it cancels the shutdown, at least for Windows 7; or is there something I didn't understand – user13267 May 2 '13 at 5:39
  • Reread it. "Type shutdown /a within the time-out period." The time-out period is the timer (/t xxx where xxx is the number of seconds). Shutdown /a will stop the timer and prevent the machine from shutting down. What if the timer was set to 0? The shutdown is immediately started. Once the shutdown itself is initiated, you cant stop it. – Keltari May 2 '13 at 5:59
  • My original understanding to the question is that if someone remotely started remote shutdown is there a way to cancel it, the answer is yes IF it is within the timed period. And as Keltari pointed out, usually remote shutdown is instant (/t 0) My bad then. I guess I did misunderstand the question. If the shutdown process already started (as Keltari pointed out) then no, I don't know if it is possible to stop it... unless somehow you can "hang" the process by.. say having a software with a pop up window demanding answer (un-saved word document stopping you from logging off anyone?) – Darius May 2 '13 at 6:28

I'm hoping to find a way to do this as well, in order to ensure postgreSQL has enough time to shutdown properly before it's terminated, but is not looking super hopeful at the moment.

This is basically just restating others' answers, but I tried these two commands from an admin prompt on Windows 7:

  1. shutdown /s & shutdown /a
  2. shutdown /s /t 0 & shutdown /a

The first command successfully aborted the shutdown as expected, while the second command didn't. This proves Keltari's statement about an immediate shutdown not being able to be aborted with shutdown /a.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.