Detecting a scheduled shutdown

Question

I have a cmd script that will execute a set of patches, and it's designed to abort if a reboot is required to avoid patching issues. I'd also like to extend the script to abort if a reboot is scheduled (E.g. via the "shutdown" command) in order to avoid reboots mid patch if possible. Unfortunately I haven't managed to find a way to detect this apart from attempting to schedule another shutdown, which results in:

A system shutdown has already been scheduled.(1190)

While I could theoretically use this I don't think it would be good practice to scare logged in users every time I needed to check for a scheduled reboot. What I really need is a way to QUERY the state modified by the "shutdown" command.

Is this possible? I'll be happy with really any solution that doesn't involve me having an application running permanently on the system to catch the shutdown events (which I don't think even get sent around until the shutdown is actually triggered)

Solution 1

I have the same problem, I searched all over, but did not find anything useful.

Eventually I just started messing around with different things I could think of. I can think of two workarounds for our problem.

The event viewer can tell you that a shutdown has been scheduled, but not WHEN it was scheduled.

One idea is to query the event viewer for the most recent system shutdown, the most recent scheduled shutdown, and the most recent cancellation of a scheduled shutdown. If the scheduled shutdown is more recent than either the most recent cancellation or shutdown then there is one in progress. The Event IDs are: 1074 for a started scheduled shutdown, 1075 for a canceled scheduled shutdown, under Windows Logs/System 12 for system start up 13 for system shutdown (all under Windows Logs/System)

I was too lazy to do this in a batch file, I know it is possible though.

So this is what I ended up doing: Rather than schedule a shutdown, just try to abort it. If no shutdown is in progress it will throw an error (Unable to abort the system shutdown because no shutdown was in progress.(1116)). Much better I think than freaking out a user by scheduling a shutdown.

Here is a copy of the code I wrote for a simple auto shutdown script, it toggles between cancelling and starting a scheduled shutdown.

@echo off
shutdown /a
if errorlevel 1 call:shutdown
goto end

:shutdown
    set /p choice=Shutdown in how many minutes? 
    set /a mod=60
    set /a mod*=%choice%
    shutdown /s /t %mod%

:end

---

EDIT - I am revisiting this answer as I have more info to add.

The Above solution will detect if a shutdown has been scheduled via the shutdown.exe command using the /t argument.

If you need to determine if Windows has schedule a shutdown (as it does automatically after some Windows Updates) then there is a registry entry that is set which you can query. The below is in PowerShell, but you can write a batch file to do the same.

Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'

Note: this will not return true if a reboot in scheduled using shutdown.exe, it will only return true if Windows says your computer need to be rebooted.

Solution 2

You can use:

Shutdown /a "for aborting the scheduled"

then use shutdown again to create another schedule.

Comments

[Ificator]

Thanks for the suggestion. I'm treating that as a last resort though as I really don't want to confuse any user on the machine with periodic "machine is restart", "just kidding" notifications.

[Ificator]

Yeah, unfortunately there are a few ways and so far I haven't figured out how the "shutdown /r /t 60" command schedules it. It doesn't appear to be a scheduled task - it's probably something much lower level which makes it hard to detect without an explicit API :(