What API-CALL is called only one time per session when you log-out or shut-down your machine?

regards
harry

Maybe ExitWindowsEx . But maybe kernel calls some internal functon to shutdown.

Do you need to hook/prevent shutdown, or do you just want a shutdown notification in your own application?

I want to hook those API to rebuild the regKEY RunOnce in the end of every session.

nothing special but a lot of user got out the WinGuard from the RUN->regKey(not exactly WinGuard but all the sequences) and I try to do the run-moment for this program "so called" invisible. I said, so called because I do not want to hide WinGuard's Icon but only run-action.
RunOnce-regKey is cleared every time afrter sys-starts and if I will be able to add the run sequence before system shuts-down, the users (it is possible but not unqestionable) do not get out WinGuard and others firms software.

this soulution is only for much support and do not keep the required security level.

When somebody will restart his machine manualy (reset-key) the runOnce sequense will be not rebuild and after system starts the required sofware will not run, so I can not drop the RUN-regKey idea for RunOnce.
I need to beprepared (as an admin) for this kind of situation.

Why not keep just the RUN entry, and protect it from user editing? Either by using ACL permissions (WinNT, regedt32 instead of regedit), or some VXD to protect parts of the registry (Win9x) - it might be a better solution, and will protect against hard-reset removal of the regkey.

BINGO!