Using Task Scheduler to Run a Task Before Shutdown

As of writing, the only options available are to "Begin the task":

• On a schedule
• At logon
• At startup
• On idle
• On an event
• At task modification/creation
• On connect to user session
• On disconnect from user session
• On workstation lock
• On workstation unlock

Is there a way to have Task Scheduler run a task before shutdown?

Even though this is an older thread, I'd like to add a solution I devised that works well.

I wanted to run a script or batch file whenever a shutdown or restart was initiated, but I didn't want to use Group Policies Shutdown Scripts function. The reason for this was pretty in depth, but I basically needed to run a script before certain services were closed.

I ended up creating a scheduled task as follows:

• Type : On Event (Basic)
• Log : System
• Source : User32
• EventID : 1074

When a user or command initiates a shutdown or restart as a logged on user or on a user's behalf, event ID 1074 will fire. By creating a task to use this to trigger a script, it will start the script and allow it to finish, however it will only report the task as "running" or "triggered" in the logs. I have not used this with a long script, so it may be worth testing further, but it works great for short scripts.

You can create shutdown tasks with the Group Policy Editor in Windows 7.

Task Scheduler is limited in its ability to schedule a task at shutdown. A similar question was asked on Stack Overflow (how-to-schedule-a-task-to-run-when-shutting-down-windows), and the answers there describe several methods other than using the Task Manager, including the Group Policy Editor method, which is described in detail and might be a better way to handle it.

The Task Scheduler can be used instead of Group Policy Editor. However, it's only good for very short tasks, which will run as long as the system is restarting or shutting down, which is usually only a few seconds.

In addition, please note that the task status can be:

The operation being requested was not performed because the user has not logged on to the network. The specified service does not exist. (0x800704DD)

However, it doesn't mean that it didn't run.

To do this you will need to set up a custom event filter in Task Scheduler.

Triggers > New > Custom > Edit Event > XML

and paste the following:

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">
    *[System[Provider[@Name='User32'] and (Level=4 or Level=0) and (EventID=1074)]]
   and 
     *[EventData[Data[@Name='param5'] and (Data='power off')]]
    </Select>
  </Query>
</QueryList>

This will filter out the power off event only.

If you look in the event viewer you can see under Windows Logs > System under Details tab>XML View that there's this.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="User32" Guid="{xxxxx-xxxxxxxxxxx-xxxxxxxxxxxxxx-x-x}" EventSourceName="User32" /> 
  <EventID Qualifiers="32768">1074</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8080000000000000</Keywords> 
  <TimeCreated SystemTime="2021-01-19T18:23:32.6133523Z" /> 
  <EventRecordID>26696</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="1056" ThreadID="11288" /> 
  <Channel>System</Channel> 
  <Computer>DESKTOP-REDACTED</Computer> 
  <Security UserID="x-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx" /> 
  </System>
- <EventData>
  <Data Name="param1">Explorer.EXE</Data> 
  <Data Name="param2">DESKTOP-REDACTED</Data> 
  <Data Name="param3">Other (Unplanned)</Data> 
  <Data Name="param4">0x0</Data> 
  <Data Name="param5">power off</Data> 
  <Data Name="param6" /> 
  <Data Name="param7">DESKTOP-REDACTED\username</Data> 
  </EventData>
  </Event>

You can test the query with the query list code above in the event viewer by clicking

Create Custom View... > XML > Edit query manually

and pasting the code, giving it a name Power Off Events Only before you try it in the Task Scheduler.