Windows 11 (and 10) shutdown producing standby event instead of preshutdown

Hi,

I am writing a windows service that needs to listen for shutdown/restart/sleep/hibernate events on Windows client (Windows 10, 11) and server (2016, 2019) OS systems and notify an external server before the system goes down. The service is working fine. It gets the SERVICE_CONTROL_PRESHUTDOWN and PBT_APMSUSPEND events. But for some reason, for the client OSes, when I shutdown the system using the start menu (or by pressing the power button or closing the lid, when they are configured to shut the system down), the service gets the PBT_APMSUSPEND event and not the SERVICE_CONTROL_PRESHUTDOWN event. Furthermore, when the system is booted up after that shutdown, the service is still running even though the service is set up to be 'Manually' started - which is the behavior one would expect if it had been suspended. So it is internally consistent, but producing the wrong event.

When the system is shutdown from the command-line (shutdown /s /t 0), it correctly produces the SERVICE_CONTROL_PRESHUTDOWN event. I am surprised by the fact that the different ways of triggering a shutdown are going down different code paths. And the service is not started on booting the system up again, as would be expected for a service that is configured to be started 'Manually'.

When the systems are rebooted/restarted (whether from the start menu or from the commandline 'shutdown /r /t 0'), it correctly produces the SERVICE_CONTROL_PRESHUTDOWN event.

Note that on a Windows 2016 and a Windows 2019 server, the shutdown from the start menu (and the power button, when configured for shutdown) is correctly producing the SERVICE_CONTROL_PRESHUTDOWN event. Since these OSes are not getting any updates anymore, I am wondering if this is a regression that has been introduced in the shutdown behavior in one of the more recent updates.

I will be testing with Windows Server 2022 as well and will post my findings here. Any help is much appreciated.