edit: I changed the script, because the old version worked not on all systems. I hope this will do it.
#Persistent SetTimer, RunBeforeShutdown, Off DllCall("kernel32.dll\SetProcessShutdownParameters", UInt, 0x4FF, UInt, 0) OnMessage(0x11, "WM_QUERYENDSESSION") Return WM_QUERYENDSESSION(wParam, lParam) { static sdtry = 0 ENDSESSION_Logoff = 0x80000000 If (lParam & ENDSESSION_Logoff) ; User is logging off. EventType = Logoff Else ; System is either shutting down or restarting. and EventType = Shutdown If (EventType = "Shutdown" and sdtry = 0){ sdtry = 1 SetTimer, RunBeforeShutdown, On Return false ; Tell the OS to Abort the Shutdown/Logoff. } Else If (EventType = "Shutdown" and sdtry = 1) Return true } runBeforeShutdown: SetTimer, RunBeforeShutdown, Off ;-------your code below RunWait, c:\windows\notepad.exe,c:\windows MsgBox, system shuts down ;------- Shutdown,9 ; your choice what to do ExitApp Return
Its a modificated script from the manual for OnMessage().
Seems to be impossible to get information what kind of shutdown is running. So you must do the choice.