Complicated Logoff

I am trying to track when the user logs off the computer. I only want to know when they log off(not restarts, not shutdowns, etc). The way I decided to handle it was by keeping a program executing constantly, invisibly, and hidden from the taskmanager. I know I can detect when windows is trying to close down my program by using the query_unload event with the constant vbappwindows, but is there any way at that point to distinguish what type of shutdown procedure is occuring. If not, I know you can subclass your form to check for power down messages. I believe the constant EWX_LOGOFF would allow me to monitor logoffs specifically, but I would rather not subclass it, if it can be avoided. Is there any api call that checks the shutdown state so I can compare it to that constant? If so, i can place that in the query_unload and allow it to handle log offs uniquely. Thank you for any input.

Joe

12