How do I find the commands that the Windows GUI executes in the background?

Question

For example if I press the shutdown button in the GUI, the shutdown command is executed in the background. How would I look that up? Is there maybe a history of OS commands?

When I look up the history in the command line, it is just the history of the commands I executed.

Answer 1

Windows does not call shutdown.exe to shutdown, it just calls the ExitWindowsEx API function directly.

To find out which API function Explorer.exe calls, you need to use a debugger or API Monitor ...