How to detect Windows shutdown or logoff

You can use a native solution via pinvoke if your code is not running in a non-interactive session (such as a system service):

//SM_SHUTTINGDOWN = 0x2000
bool bShutDownPending = GetSystemMetrics(SM_SHUTTINGDOWN) != 0;

Attach an event handler method to the SystemEvents.SessionEnding event, and your handler method will be called each time the event is raised. Handling this event will allow you to cancel the pending log off or shut down, if you wish. (Although that doesn't actually work like it sounds in current operating systems; for more information see the MSDN documentation here.)

If you don't want to cancel the event, but just react to it appropriately, you should handle the SystemEvents.SessionEnded event instead.

You must make sure that you detach your event handlers when the application is closed, however, because both of these are static events.