For example if I press the shutdown button in the GUI, the shutdown command is executed in the background. How would I look that up? Is there maybe a history of OS commands?

When I look up the history in the command line, it is just the history of the commands I executed.

CodePudding user response：

Windows does not call shutdown.exe to shutdown, it just calls the ExitWindowsEx API function directly.

To find out which API function Explorer.exe calls, you need to use a debugger or API Monitor...