According to MSDN, it is not possible to determine whether a reboot or shutdown has occurred using the WM_ENDSESSION message.
I found the only way , but it is pretty ugly and only works for Windows 2000 Server, not for the 2008 server.
The reason I ask is because I am in the process of porting a Linux daemon for Windows as a system service. This daemon acts differently on reboot and system shutdown events.
I also use python with pywin32 in the project if it somehow helps to answer.
source share