What API should I call to abort Logoff/Shutdown ?

[kbern3]

I need to write a script that will run every time someone tries to log
off or shutdown a computer. In the past people have logged off
computers while virtual machines were running QE tests or automation.
So it would always be a real pain when these VMs were shut off without
warning. I need to write a script that would check for VMware's
executable file (vmware-vmx.exe) and (if the process is found) prompt
a warning to the user and stop the shut down or log off process from
happening.

I've done A LOT of research on the internet about logoff/shutdown
scripts, posted on message boards and I've emailed people that I
know. I've found four different API calls/messages and I can't move forward with my scripts until I find out which one I should use:


AbortSystemShutdown - This call aborts a shutdown initiated by
InitiateSystemSutdown or InitiateSystemShutdownEx calls. ASS is
thrown during the timeout period specified by ISS or ISSE. I don't know if it
will work for the console session since ISS and ISSE are only used in
RDP connections. Does anyone know if this call work to abort a
shutdown initiated by ExitWindowsEx?

ExitWindowsEx - Can shutdown, logoff, or restart a computer and pass
reasons to the event log as to why any of these happened. I know that this API sends the WM_QUERYENDSESSION message which can potentially abort a logoff/shutdown if the a value of "0" is returned. How do I respond to this message with "0" in a script? I haven't found any examples on the internet.

SystemEvents.SessionEnding - Can cancel shutdown. I don't know if this is the best API to use though. There are too many caveats: console apps don't raise this event, cancel only works sometimes, and there's no
guarantee this event will fire before the closing event fires.

I would appreciate any help or suggestions you all can give me.

P.S. Just in case your wondering, I'm aware of the fact that I can't
directly call an API from a script and that I have to use either MS
Office as proxy to load the code into a macro to make the calls or use
an ActiveX control to act as a wrapper to make the calls. Sorry this
post is so long.