How do you detect the Windows XPe shutdown reason in Delphi?

Question

I'm correctly intercepting the Windows shutdown message WMQueryEndSession in Delphi 2009 with the following procedure:

procedure TMyForm.WMQueryEndSession(var msg: TMessage);

This article suggests that I can distinguish between a regular shutdown and a log off by examining the LParam of message.

http://msdn.microsoft.com/en-us/library/windows/desktop/aa376890%28v=vs.85%29.aspx

Update:

I'm developing an application to run on Windows XP Embedded, and in my case, the LParam is 0 every time however.

If I test my application under Windows 7 or Windows XP Home then I get the expected $80000000.

Any pointers would be greatly appreciated!