I think you cannot suspend the shutdown process, but you can cancel it returning FALSE to the WM_QUERYENDSESSION message. Maybe, while you are in your WM_QUERYENDSESSION message handler, the shutdown process is suspended, except when ExitWindowsEx was called with the flag EWX_FORCEIFHUNG, but I'm not sure about that.