How can I find out in the console (CMD) whether a system shutdown has been initiated?

Question

System administration

Hello!
Using the shutdown.exe program, you can initiate a restart/shutdown of the computer.
The question is: how do you know when a shutdown/reboot is scheduled, and what is scheduled, reboot/shutdown?
For example, I called shutdown.exe with the following switches -r -f -t 6000, how can I now find out in the console when the reboot will occur? And will it be a reboot, and suddenly a shutdown?
For what? I want to check in zabix...

Answer 1

There is no simple API for getting this information.
EventLog ID 1074 (STATUS_SHUTDOWN_CLEAN) - scheduled restart event (including pending ones)
EventLog ID 1074 (WARNING_ISSE_SHUTDOWN_CANCELLED) - restart cancellation event (including pending ones)
Postponing restart via shutdown /t времяcalls the wlmdr process .exe that draws a bubble saying " Your session will be terminated. Windows will be terminated in 111 minutes ".
The presence of a fresh EventLog by ID 1074 and the presence of wlmdr.exein processes may indicate a scheduled shutdown/restart. On these two conditions, you can build a trigger.
You can check the status of "ShutdownInProgress" and "ShutdownTime" with a debugger by hooking into winlogon.exe.
https://blogs.msdn.microsoft.com/ntdebugging/2007/...
Of course, this is a much more difficult path, which is not very suitable for mass execution of Zabbix on employee workstations.