Not only that, but apparently WM_QUERYENDSESSION is not sent to applictions in Vista (I googled that, so don't quote me on it).

It seems to me that you have basically solved the problem. Use the CloseReason enumeration to detect primarily why the form is closing, but if the enumeration equals `None`, then use the override on the WndProc to determine if it is caused by a LogOff...