Jump to content
Sign in to follow this  

Detect System Shutdown

Recommended Posts

Hello all,

I'm trying to detect the following window :

>>>> Window Title <<<<
System Shutdown

>>>> Window Dimensions <<<<
X: 631    Y: 455    Width: 282    Height: 251

>>>> Mouse Co-ords (relative to active window) <<<<
X: -465 Y: -268

>>>> Window Text <<<<
This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by DOMAIN\USER
Time before shutdown :
Your system will now restart to complete the installation,you must logon to finish

But I'm not having any luck at the moment.

Any tips or hints ?

Edited by Amaruq

Share this post

Link to post
Share on other sites

I just tested executing

RunWait,%comspec% /c shutdown /l /t:1800 /y /c,,hide
IfWinExist,System,This system is shutting down,MsgBox,0,...,So we are going to leave?

And it worked... What is your problem?

Share this post

Link to post
Share on other sites

The problem is that I don't control the shutdown parameters.

There is a sequence of maximum 12 reboots and only the last one has an altered message => "you must logon to finish" is added.

So I'm trying to detect the last reboot by looking at the complete window text.

Share this post

Link to post
Share on other sites

At every startup (put script in startup folder or set it in autoexec.bat or set in Run/RunOnce @ the registry) an ini file (StartUpMonitor.ini) will be triggered to deliver/get a status about the number of logins which have been done already.






IfNotExist, C:\\StartUpMonitor.ini, Goto, IniCreate

IniRead, NoSessions, C:\\StartUpMonitor.ini, Startup, Sessions

IfGreater, NoSessions, 11, Goto, LastSession

EnvAdd, NoSessions, 1

IniWrite, %NoSessions%, C:\\StartUpMonitor.ini, Startup, Sessions


IniWrite, 0, C:\\StartUpMonitor.ini, Startup, Sessions




FileAppend, [startup]\nSessions=1, C:\\StartUpMonitor.ini


Would this help?

Share this post

Link to post
Share on other sites

I'm afraid not :/

The problem is that I have to monitor an EXE that will reboot up to 12 times.

But it can also be 10 or 11 times.

I'm trying another route now and that is monitoring the AutoAdminLogon key in the registry.

Hopefully that will work.

Thanks for the replies so far !

Share this post

Link to post
Share on other sites

Why not check for the exe's process ID (with PSList from www.sysinternals.com) ?



Most UNIX operating systems ship with a command-line tool called "ps" (or something equivalent) that administrators use to view detailed information about process CPU and memory usage. Windows NT/2K comes with no such tool natively, but you can obtain similar tools with the Windows NT Workstation or Server Resource Kits. The tools in the Resource Kits, pstat and pmon, show you different types of information, and will only display data regarding the processes on the system on which you run the tools.

PsList is utility that shows you a combination of the information obtainable individually with pmon and pstat. You can view process CPU and memory information, or thread statistics. What makes PsList more powerful than the Resource Kit tools is that you can view process and thread statistics on a remote computer.


Just copy PsList onto your executable path, and type "pslist".

PsList works on Windows NT, Windows 2000 and Windows XP.


The default behavior of PsList is to show CPU-oriented information for all the processes that are currently running on the local system. The information listed for each process includes the time the process has executed, the amount of time the process has executed in kernel and user modes, and the amount of physical memory that the OS has assigned the process. Command-line switches allow you to view memory-oriented process information, thread statistics, or all three types of data.

usage: pslist [-?] [-d] [-m] [-x][-t][-s [n] [-r n]][\\computer [-u username] [-p password]] [name | pid]

-? Displays the supported options and the units of measurement used for output values.

-d This switch has PsList show statistics for all active threads on the system, grouping threads with their owning process.

-m This switch has PsList show memory-oriented information for each process, rather than the default of CPU-oriented information.

-x With this switch PsList shows CPU, memory and thread information for each of the processes specified.

-t Shows the tree of processes.

-s [n] Has PsList run in task-manager-like updating mode. You can optionally specify the number of seconds it runs and abort it by pressing the escape key.

-r n Task-manager mode refresh rate in seconds (default is 1).

name Instead of listing all the running processes in the system, this parameter narrows PsList's scan to those processes that begin with the name process. Thus:

pslist exp

would statistics for all the processes that start with "exp", which would include Explorer.

-u username If you want to kill a process on a remote system and the account you are executing in does not have administrative privileges on the remote system then you must login as an administrator using this command-line option. If you do not include the password with the -p option then PsList will prompt you for the password without echoing your input to the display.

-p password This option lets you specify the login password on the command line so that you can use PsList from batch files. If you specify an account name and omit the -p option PsList prompts you interactively for a password.

\\computer Instead of showing process information for the local system, PsList will show information for the NT/Win2K system specified. Include the -u switch with a username and password to login to the remote system if your security credentials do not permit you to obtain performance counter information from the remote system.

pid Instead of listing all the running processes in the system, this parameter narrows PsList's scan to tthe process that has the specified PID. Thus:

pslist 53

would dump statistics for the process with the PID 53.

How it Works

Like Windows NT/2K's built-in PerfMon monitoring tool, PsList uses the Windows NT/2K performance counters to obtain the information it displays. You can find documentation for Windows NT/2K performance counters, including the source code to Windows NT's built-in performance monitor, PerfMon, in MSDN.


PsList is part of a growing kit of Sysinternals command-line tools that aid in the adminstration of local and remote Windows NT/2K systems named PsTools.

Download PsList (23KB)

Download PsTools Suite

Share this post

Link to post
Share on other sites

Seems like a very handy tool.

However the shutdown is triggered from within the exe and the exe keeps running untill the shutdown forces all running applications to close.

So this would not give me enough time to let my script run.

I have managed to pull it off by monitoring the reg key.

Thanks all for the replies !

Share this post

Link to post
Share on other sites
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Create New...