Debes interceptar el mensaje WM_ENDSESSION:
Código Delphi
[-]
type
TForm1 = class(TForm)
private
procedure WMEndSession(var Msg: TWMEndSession); message WM_ENDSESSION;
end;
implementation
procedure TForm1.WMEndSession(var Msg: TWMEndSession);
begin
memo1.lines.savetofile('C:\logula.txt');
end;
// Saludos