At what point would WM_ENDSESSION be called with wParam being 0?

Question

I'm trying to understand WM_ENDSESSION notification. What circumstance would it be called with wParam being 0?

I understand that it is set to TRUE if the session is ending. But what else can it do.

Answer 1

The answer is in the documentation you linked to in your question:

lParam
This parameter can be one or more of the following values. If this parameter is 0, the system is shutting down or restarting (it is not possible to determine which event is occurring).

ENDSESSION_CLOSEAPP
0x1

If wParam is TRUE, the application must shut down. Any data should be saved automatically without prompting the user (for more information, see Remarks). The Restart Manager sends this message when the application is using a file that needs to be replaced, when it must service the system, or when system resources are exhausted. The application will be restarted if it has registered for restart using the RegisterApplicationRestart function. For more information, see Guidelines for Applications.

If wParam is FALSE, the application should not shut down.

An app receives WM_ENDSESSION if it responds TRUE to WM_QUERYENDSESSION to allow logout/shutdown.

When receiving WM_ENDSESSION, if lParam is ENDSESSION_CLOSEAPP, wParam may be FALSE to indicate logout/shutdown has been cancelled and the app does not need to exit after all.