in reply to Re^2: Catching system events, via WMI
in thread Catching system events, via WMI

While it's possible that I'm seriously misunderstanding the issue, I do believe that it's completely unnecessary to catch the logout event because Windows already has this hook built-in. See this technet explanation. The links on that page offer more details.

In other words, your script will only be triggered on this event so there will never be a need to look for it -- it'll only run when appropriate.