In Windows 7 script, how can I determine if current system shutdown is actually a reboot?

Question

I use the Group Policy Editor which is part of Windows 7 (also of Windows XP) to run a so-called shutdown script, which will automatically be executed each time the system is shutdown or rebooted. My problem is: I need to know in my script if the user has selected to shutdown the system, or if he has selected reboot instead. Both actions will make Windows run the shutdown script, but how can I determine during that script execution which action was actually performed?

Is there any way to know, during shutdown, if the system currently performs a shutdown or a reboot?

Answer 1

On pre-vista systems you can query the Registry:

The Shutdown Setting DWORD found under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer stores the setting selected most recently from the list on the Shut Down Windows dialog box for the current user.

On more recent systems, you can query the System Eventlog in your shutdown script, like this:

$systemstateentry = get-eventlog -LogName system -Source User32 | ?{$_.eventid -eq 1074} | select -first 1

switch -regex ($systemstateentry.message) 
    { 
        ".*restart.*" {"restart"} 
        ".*power off.*" {"power off"} 
        default {"unknown"}
    }